Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited CVE-2026-110447, a critical unauthenticated remote code execution vulnerability in Collabora's CODE app bundled with Nextcloud, to plant persistent web shells on unpatched servers. The flaw was triggerable specifically when the local document server was not actively running, meaning even lightly-used or misconfigured deployments were at risk. This incident highlights the danger of third-party or bundled applications expanding an organization's attack surface without receiving the same patching scrutiny as the core platform. Because no authentication was required to exploit the flaw, any internet-facing Nextcloud instance with the CODE app installed was potentially exposed to full server compromise. Timely patching and active inventory management of all integrated components are essential to preventing this class of supply-chain-adjacent attack.