Nextcloud Servers Exposed as Hackers Plant Web Shells via Collabora CODE Zero‑Day
Attackers are backdooring Nextcloud servers through a critical flaw in Collabora’s Built‑in CODE app (CVE‑2026‑110447), dropping PHP web shells that survive even if the app is disabled. The breach window puts governments, companies, and nonprofits that use self‑hosted collaboration suites at risk of silent data theft and long‑term compromise.
A critical flaw in a popular office integration for Nextcloud has opened a fresh path for attackers to quietly take over servers that store sensitive documents, emails, and internal chat logs.
Security researchers disclosed that unknown threat actors are exploiting a vulnerability tracked as CVE‑2026‑110447 in Collabora’s Built‑in CODE app, which integrates an online document editor into Nextcloud instances. By abusing the bug, they’ve been able to plant PHP web shells—lightweight scripts that give remote command‑line access—on vulnerable servers.
The detail that alarms defenders most: simply disabling the Built‑in CODE app is not enough to close the hole. Exploitation requires the app’s local document server to be down, but once attackers have used the window to upload their web shell, the backdoor can persist even if administrators later switch features off.
Nextcloud is widely used by small and midsize businesses, universities, NGOs, and some public‑sector bodies as a self‑hosted alternative to big‑tech cloud suites. That makes it a valuable target. A compromised instance can expose internal files, allow attackers to pivot deeper into a network, and serve as a launchpad for phishing against staff and partners.
The attackers’ choice of PHP web shells suggests they’re aiming for long‑term presence rather than smash‑and‑grab attacks. With a web shell in place, an intruder can exfiltrate data slowly, add new user accounts, alter documents, or install ransomware at a time of their choosing. Because the commands flow over regular HTTPS traffic, many intrusion‑detection systems will struggle to distinguish malicious use from normal collaboration.
Vendors have moved quickly to provide a fix. Administrators are being urged to update the Collabora Built‑in CODE app to version 26.4.303 or later, or to remove it entirely from stacks where it isn’t essential. Given that disabling the app alone doesn’t scrub already‑installed web shells, security teams will also need to run audits for unexpected PHP files, review web server logs for suspicious requests, and consider restoring from known‑good backups where compromise is suspected.
The incident underlines a broader point about modern collaboration platforms: the weakest link is often not the core product but a convenient plugin.
In this case, organizations that proudly maintain on‑premise Nextcloud servers to avoid third‑party clouds have discovered that a bundled convenience feature tied them back into the same zero‑day ecosystem as everyone else. The risk is especially sensitive for entities handling personal data, legal documents, or confidential government material.
So far, there’s no public attribution of the campaign to a specific crime group or state actor, and no confirmed tally of affected organizations. But the method—backdooring widely deployed open‑source stacks via a single third‑party component—fits a pattern seen in previous supply‑chain and cloud‑service attacks.
Defenders should watch for threat‑intelligence reports that provide indicators of compromise specific to this exploitation path, patches or configuration guidance from both Nextcloud and Collabora, and any regulatory advisories that spell out disclosure obligations if sensitive data is found to have been accessed. If the exploitation spreads, it may push more organizations to rethink how they vet and sandbox the growing web of apps that sit inside their collaboration hubs.
Sources
- OSINT