Attackers used a flaw in Collabora Online – Built-in CODE Server (richdocumentscode) to plant web shells on Nextcloud hosts, with the first reported attack logged on September 10 and Collabora fixing it in version 26.4.303. Collabora later tied the issue to CVE-2026-110447 and said disabling the app is not enough.
The bug sits in the app’s startup path: when the local CODE server is not running, the PHP script builds a shell command from the request path, and a crafted path can smuggle shell syntax into that command. That makes a restart, crash, or upgrade the dangerous moment, because the web server can end up running attacker code as its own account.
For self-hosted Nextcloud deployments that use the built-in CODE app, the exposure lives in transient maintenance windows as much as in the app itself. Systems that only use a separate Collabora server are outside this issue, but any host still relying on richdocumentscode before 26.4.303 carries the web-shell risk until it is updated or removed.