Critical Flaw in Collabora's CODE Server Backdoors Nextcloud Servers
Article Content
- •CVE-2026-110447 is a critical vulnerability with a CVSS score of 9.2.
- •Attackers exploited the flaw to plant web shells on Nextcloud servers.
- •Users must upgrade to version 26.4.303 or remove the app to mitigate risks.
A critical vulnerability (CVE-2026-110447) in the Collabora Online - Built-in CODE Server app allows attackers to execute commands on Nextcloud servers via unauthenticated requests. The flaw was exploited to plant web shells, with the first attack reported on September 10, 2026. Collabora issued a fix on September 11, 2026, but users must upgrade to version 26.4.303 or remove the app to mitigate the risk. The vulnerability only affects Nextcloud servers running the app when the local document server is not active, such as during restarts or upgrades. Standalone Collabora Online servers are not impacted. Users of Nextcloud versions 29 and older, which are end of life, are particularly at risk as they may still receive the vulnerable version of the app. Collabora's advisory emphasizes that simply disabling the app is insufficient for protection.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track Collabora and CVE-2025-66208 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions are affected?
Is this vulnerability being actively exploited?
What should I do if I use this app?
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…