Attackers have been exploiting a critical vulnerability in Collabora Online’s built-in CODE server app for Nextcloud since mid-September. Tracked as CVE-2026-110447, the flaw allows remote command execution through the app’s proxy.php endpoint when the server is stopped. The vulnerability affects versions of richdocumentscode before 26.4.303. Hackers have sent malicious requests to compromise systems, installing PHP webshells to search for passwords, password manager data, and cryptocurrency wallets. Some reports suggest ransomware operators are also leveraging the flaw, though this has not been independently verified.
A significant delay between the security fix and formal vulnerability disclosure has complicated the response. The patch was released on September 11, but the CVE was not published until October 14—a gap of over four weeks. During this period, attackers exploited the flaw while administrators lacked a CVE identifier to implement defenses effectively. Collabora and Nextcloud attributed the delay to GitHub’s backlog of AI-generated vulnerability reports. Administrators are urged to upgrade to version 26.4.303 or remove the app entirely, as disabling it alone is insufficient.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
