Collabora RCE Flaw Targets Nextcloud Servers

Summary: Threat actors are exploiting a critical remote code execution (RCE) flaw in the Collabora Online app for Nextcloud. This vulnerability, tracked as CVE-2026-110447, is being used to backdoor Nextcloud servers.

A critical RCE vulnerability (CVE-2026-110447) has been identified in the Collabora Online - Built-in CODE Server app used in Nextcloud environments. This flaw allows attackers to gain unauthorized access to Nextcloud servers and install backdoors. This poses a significant security risk, especially for Nextcloud installations storing sensitive data.

The vulnerability resides in the richdocumentscode component of the Collabora Online app, which provides document editing functionality within Nextcloud. RCE flaws typically arise from applications failing to properly validate or sanitize user input. This allows attackers to execute arbitrary commands on the server.

For live systems, this situation necessitates an immediate review of Nextcloud server security. It is critical for administrators to check for and apply any available patches for the Collabora Online app. Failure to do so could result in data breaches or complete system compromise.

Teams utilizing Nextcloud and Collabora integration should regularly monitor and automate security updates for such applications. Additionally, monitoring server logs and using SIEM solutions to detect anomalous activities would be beneficial.

🔗 Source: BleepingComputer
📡 Authoritative feeds & live tracking: Radar