Nextcloud: exploited since September 10, the Collabora flaw wasn't disclosed until October 14

On September 11, a Nextcloud server administrator opened a ticket on Collabora's GitHub repository. Its title was explicit: “Security issue - Hack”. In an application's folder, they had found a small PHP file that shouldn't have been there. It's a backdoor that runs any command sent through a simple web address. Other administrators quickly described the same thing. Yet it took until October 14 for an official security advisory and a vulnerability ID to be published.

The flaw, tracked as CVE-2026-110447, affects the Collabora Online - Built-in CODE Server application (technical name richdocumentscode). It lets users edit office documents in Nextcloud without installing a separate server. Collabora rates it critical, with a score of 9.2 out of 10 (CVSS 4.0 scale). Versions earlier than 26.4.303 are vulnerable. The patch has been available since September 11 in Nextcloud's app store.

One request is enough, no password needed

According to Collabora's advisory, a booby-trapped request sent to the application's proxy.php file can run a system command with the web server's privileges. No account and no user action are required. One condition applies: the built-in office server must be stopped at that moment, which happens after a restart, an update or a crash.

According to accounts posted in the ticket, the attacks began around September 10. The attackers dropped files named shx*.php, then searched for password databases, password manager files and cryptocurrency wallets. Some users reported the involvement of ransomware operators, which BleepingComputer could not confirm. Nextcloud, for its part, says it has not observed large-scale exploitation.

One important point: only the built-in application is affected. Again according to Collabora, standalone Collabora Online servers, Docker installations, RPM and DEB package installations, and Nextcloud All-in-One are not affected.

Why a month of silence?

The patch was written on September 9 and released two days later. But the release notes made no mention of security, and users were still asking for a vulnerability ID at the end of September. Collabora blames the delay mainly on a backlog in CVE processing at GitHub, which the vendor says is overwhelmed by a flood of AI-generated vulnerability reports. This phenomenon was already visible in the case of curl. Nextcloud argues the opposite: that the delay gave users time to update.

The problem goes beyond Collabora. According to the company Second Security, cited by BleepingComputer, the median delay between a public patch and CVE publication reached 39 days in August, up from 5.1 days in January. Vulnerability tracking tools, which rely on CVEs, stay silent in the meantime.

What to do

If the built-in application is installed on your Nextcloud, assume it may have been attacked since September.

• Update richdocumentscode to version 26.4.303 or later, or remove the application if you don't use it. Collabora warns that disabling it is not enough.
• On end-of-life Nextcloud versions (29 and earlier), update Nextcloud or remove the application.
• Look for shx*.php files in the application folder and delete them. Run Nextcloud's integrity check, which spotted some on one administrator's server.
• In the web server logs, look for requests to /apps/richdocumentscode/proxy.php containing %2e%2e sequences.
• If you find any suspicious trace, treat all data accessible to the web server account as exposed, and change the secrets stored there.

One question remains: how many servers were hit between September 10 and today? Neither Collabora nor Nextcloud has offered a figure.