Nextcloud's Built-in Collabora Server Was Attacked for Four Weeks Before Its CVE Existed
Security / news
Nextcloud's Built-in Collabora Server Was Attacked for Four Weeks Before Its CVE Existed
CVE-2026-110447 had a fix on Sept. 11, a CISA catalog entry on Oct. 23, and a 33-day gap in between during which admins found webshells.
Attackers began exploiting an unauthenticated command injection in the richdocumentscode app for Nextcloud on Sept. 10, a day before version 26.4.303 fixed it and 34 days before the CVE, CVE-2026-110447, was published on Oct. 14. CISA added it to the Known Exploited Vulnerabilities catalog on Oct. 23 with a deadline of Oct. 26.
The flaw sits in proxy.php in the Built-in CODE Server app, the bundled copy of Collabora Online that Nextcloud installs through its app store. It is exploitable only when that built-in server is not running, such as after a restart, upgrade or crash, and it needs no login. Standalone Collabora Online servers, Docker and RPM or DEB installs, and Nextcloud All-in-One deployments are not affected, according to Collabora.
The timeline from fix to advisory
BleepingComputer's Oct. 15 report and eSecurityPlanet's agree on the sequence, which is the story here more than the bug.
| Date | Event |
|---|---|
| Sept. 9 | Collabora commits the fix |
| Sept. 10 | Earliest attack reports |
| Sept. 11 | Version 26.4.303 released |
| Oct. 3 | Community warning on help.nextcloud.com urges updates |
| Oct. 14 | Advisory GHSA-g3vx-3m76-fghh and CVE published |
| Oct. 23 | CISA adds CVE-2026-110447 to its catalog |
The CISA date and deadline come from the agency's catalog data, where the entry is titled "Collabora Online – Built-in CODE Server OS Command Injection Vulnerability". Ransomware use is listed as unknown. BleepingComputer said some users reported ransomware operators exploiting the flaw but that it could not confirm this.
An administrator who patched on Sept. 11 was safe. One who tracked advisories instead of app updates had no CVE to track until Oct. 14, and a patched server can still carry a webshell planted earlier.
Why the CVE arrived 33 days after the fix
Nextcloud said the delay gave users time to update and that it had not seen widespread exploitation, BleepingComputer reported. Collabora blamed the delay mainly on backlogs in GitHub's CVE processing, which it attributed to rising volumes of AI-driven security reports.
BleepingComputer cited a Second Security study that put the median gap between a public fix and CVE publication at 39 days in August, up from 5.1 days in January. The Terminal has not seen that study. The same report said public exploit code often appears within hours of a fix, which is the risk of a quiet patch: the diff announces the bug before the advisory does.
What attackers did and what to check
Per Collabora's advisory, an unauthenticated attacker can "execute operating system commands" with the web server account's privileges. The reports reviewed did not show root access.
eSecurityPlanet listed the indicators:
- PHP webshells in
apps/richdocumentscode/, with names matchingshx*.phpand one calledshrf4645.php. - Requests to
proxy.php?statuscarrying$(or${IFS}. - Failed
sudoattempts by the web server account.
Administrators found the webshells searching for password-manager files and cryptocurrency wallets, BleepingComputer said. In the original GitHub incident report, payloads tried to send system information to webhook callbacks. eSecurityPlanet said no file archiving or upload was shown, so credential theft is not established.
The score is not in either report, so severity here rests on preconditions: no authentication, but a stopped CODE server. That condition is routine on a host that reboots for kernel updates.
What to do
Update richdocumentscode to 26.4.303 or later, or remove the app if you do not use it. Collabora's advisory says "disabling the app is not sufficient." Nextcloud 29 and earlier are end of life, and eSecurityPlanet said Collabora advises upgrading Nextcloud or removing the app on those.
Patching does not evict an attacker already inside. Review access logs back to Sept. 10, inspect the app directory for stray PHP files, and rotate credentials the web server account could read. Related reading: AhsayCBS 10.3.4 was not the fix and PHP2Shell's unpatched third flaw show the same patch-versus-advisory gap on other products.
CISA's Oct. 26 deadline applies to federal agencies only. Everyone else's was Sept. 11.
Sources
More in Security
- 01SiteGuard WAF Flaw CVE-2026-106931 Is Exploited, and Patching Can Erase the EvidenceA local-vector command injection scored 8.5 gives root or SYSTEM on the firewall host, and the vendor tells customers to download diagnostics before updating.
- 02SafePay Ransomware Hit 600 Victims, and the Advisory's Newest CVE Is From 2024The FBI, CISA and German and British police list five vulnerabilities in AA26-293A, none newer than 2024, alongside a credential-first playbook that needs no exploit at all.
- 03Gheist Used 850 Stolen GitHub Tokens to Print Secrets Into Workflow LogsWiz Research recovered more than 13,500 planted branches, and GitHub's July approval hold stopped every public-repository run but not private or Enterprise Server ones.
- 04Siemens Software Center Flaw CVE-2026-110936 Is Exploited Through a Signed Copy of Its Own AppAttackers never modified Siemens' executable: they shipped a valid, signed copy with their own files beside it, and CISA listed the bug on Oct. 20.