Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited a critical vulnerability in the Collabora Online - Built-in CODE Server, an optional app for Nextcloud, to plant web shells on affected servers. The web shells allow attackers to execute arbitrary commands with the privileges of the web server account. At least three Nextcloud administrators reported the issue on GitHub, with the first confirmed attack occurring on September 10. A web shell is a small malicious file that executes commands sent via web requests. The attack vector is the optional Collabora Online integration, which is widely used for document editing within Nextcloud. The incident highlights risks associated with third-party integrations in self-hosted cloud platforms. Server administrators running Collabora's CODE app are strongly advised to patch or disable the component immediately.