Attackers plant web shells on Nextcloud servers through Collabora CODE app flaw
A bug in Nextcloud's built-in Collabora Online CODE Server lets attackers run commands as the web server user. Admins started reporting live attacks on September 10.
Key points
- A flaw in the Collabora Online Built-in CODE Server app for Nextcloud lets an attacker run operating system commands as the web server account, with the first live attack reported on September 10.
- The fix is in the patched richdocumentscode release; disabling the app isn't enough, admins must upgrade or remove it entirely.
- The attack only works when the built-in CODE server isn't currently running, so it fires after a container restart or a crash.
- Standalone Collabora Online servers are not affected, only the bundled app that ships with Nextcloud.
- This is a separate bug from the earlier Collabora CVE, and that previous patch doesn't block it.
Attackers are breaking into Nextcloud servers through an optional add-on called Collabora Online Built-in CODE Server, the component that lets users open and edit office documents inside Nextcloud. Three administrators flagged the attacks on GitHub, with the earliest logged intrusion dated September 10.
The payload is a web shell, a small file dropped onto the server that runs whatever command an attacker sends over a normal web request, using the same account the web server itself runs as. Once it's in place, the server is effectively under remote control. We covered a near-identical technique in our 30 September story on the Zimbra mail server intrusions, where attackers dropped web shells to steal mailbox data before anyone noticed.
How does the attack work?
A request to the app's proxy.php triggers an operating system command as the web server user. The Collabora advisory flags one quirk that matters for defenders: the attack only lands while the built-in CODE server isn't running. A container restart or a crash opens the window.
That timing detail is why disabling the app won't save you. The vulnerable code path still answers the request, so the only safe moves are upgrading or removing the app entirely.
Which versions are fixed?
The bug was patched in Collabora Online Built-in CODE Server (package name richdocumentscode). Admins should check the Collabora advisory for the confirmed fixed version and act immediately.
| Item | Detail |
|---|---|
| Affected app | Collabora Online Built-in CODE Server (richdocumentscode) |
| First reported attack | September 10 |
| Not affected | Standalone Collabora Online servers |
| Related but separate | Earlier Collabora CVE (fix does not cover this bug) |
Is this the same as the earlier Collabora CVE?
No. The advisory is explicit that this isn't the same code path as the previously patched flaw, and that earlier fix doesn't prevent this one. Admins who patched weeks ago and assumed they were done need to look again.
Two distinct bugs, in the same bundled app, both reachable without authentication in the way these attacks are being described. The Hacker News, which picked up the GitHub reports, framed this as a critical issue, and on the behaviour alone (command execution as the web server account, active exploitation, patch-or-remove guidance) that reading holds up.
What should admins actually do?
Upgrade richdocumentscode to the fixed version or remove it. If removal isn't immediate, check the server for files you didn't put there, especially anything new under the web root, and review web server logs around any recent restart or upgrade window for odd requests to proxy.php.
Something worth saying plainly: Nextcloud is often run by small teams and local councils who picked it precisely to keep documents off big cloud platforms. Those operators are the least likely to be watching a GitHub security advisory feed. The window between disclosure and someone noticing their server has a web shell on it is going to be the story here, not the CVE number.
