Flaw in Nextcloud's Built-in Collabora CODE App Exploited to Plant Web Shells

According to a report from The Hacker News, attackers have been exploiting a flaw in Collabora Online - Built-in CODE Server, an optional app bundled with Nextcloud, to plant web shells on compromised Nextcloud servers. Three administrators reported the activity on GitHub, with the earliest known attack logged on September 10.

A web shell gives an attacker a persistent, remote command-execution foothold on the server, typically running with the privileges of the web server process. Details on the underlying vulnerability's root cause, CVSS score, and patch status were not included in the available reporting.

Why It Matters

Nextcloud is widely deployed for self-hosted file sharing and collaboration, often by organizations handling sensitive documents. The Collabora Online CODE app is an optional component for in-browser document editing, so exposure depends on whether an organization has that app installed and enabled. A successful web shell deployment can lead to data theft, lateral movement, or further backdooring of the host.

What Defenders Should Watch For

• Audit whether the Collabora Online - Built-in CODE Server app is installed and enabled on your Nextcloud instances, and check for vendor advisories or updates addressing this flaw.
• Review web server access logs for unusual POST requests or unfamiliar file paths under the Nextcloud app directories, particularly around and after September 10.
• Hunt for newly created or recently modified PHP (or other server-side script) files in Nextcloud app and data directories that don't correspond to a known update or deployment.
• Monitor for anomalous outbound connections or command execution originating from the web server account/process.
• If the CODE app isn't actively needed, consider disabling it to reduce attack surface until a fix is confirmed and applied.

This is developing, net-new intelligence based on community reports rather than an official vendor advisory, and specifics (CVE, patch availability, full technical details) were not confirmed in current reporting. For the original report, see The Hacker News.