As noted by The Hacker News, attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. The issue was first reported by three administrators on GitHub, with the earliest logged attack occurring on Sept. 10.
The vulnerability, identified as CVE-2026-110447, allowed unauthenticated requests to execute commands on the server, specifically when the app's local document server was not running, such as during restarts or upgrades. Attackers could insert commands into the request path, which the server would then execute with the web server account's privileges. This allowed them to deploy web shells, which are small files used to execute commands remotely. The affected app, richdocumentscode, is intended for local testing and non-production use. Collabora released a fix in version 26.4.303 on Sept. 11, and later issued an advisory on Oct. 14. The advisory warned that simply disabling the app was insufficient; it required updating or complete removal. The exploit was observed in the wild during September and October 2026, with attackers searching for credential stores and cryptocurrency wallets. While root access was not reported, any data readable by the web server account is considered potentially exposed. Users are advised to update the richdocumentscode app to version 26.4.303 or later, or remove it entirely. For older Nextcloud versions that cannot install the fix, upgrading Nextcloud or removing the app is necessary. Administrators who have updated should also check for and delete any leftover malicious PHP files and review access logs for suspicious activity.
Source: The Hacker News
