Critical Flaw in Collabora CODE Lets Hackers Plant Web Shells on Nextcloud Servers

Security researchers have uncovered a serious vulnerability in the Collabora Online – Built-in CODE Server app that can be used to insert malicious web shells into Nextcloud installations, effectively granting attackers persistent remote access.

The defect resides in the optional CODE app that many Nextcloud administrators enable to provide in‑browser document editing. By exploiting a remote code execution weakness, threat actors were able to upload small scripts—known as web shells—that allow them to run arbitrary commands on the compromised host.

The issue first came to public attention after three Nextcloud administrators posted detailed reports on the project's GitHub tracker, noting that the earliest confirmed intrusion occurred on September 10. The administrators described how the malicious files appeared in otherwise normal server directories, indicating a stealthy backdoor rather than a typical ransomware drop.

Web shells are prized by attackers because they offer a low‑profile foothold that can be used to exfiltrate data, modify files, or pivot to other systems on the network. Given the widespread adoption of Collabora for collaborative editing, the vulnerability potentially affects a large number of enterprises, educational institutions, and public‑sector deployments that rely on Nextcloud as a file‑sharing platform.

Collabora has responded by releasing a security patch that addresses the underlying code execution flaw, and the Nextcloud community is urging users to either apply the update immediately or temporarily disable the CODE app until the fix is verified. Administrators are also advised to scan their servers for unauthorized web shells and to rotate any credentials that may have been exposed.

The incident highlights the broader risk posed by third‑party extensions in open‑source ecosystems, where a single vulnerable component can compromise an otherwise secure deployment. Security experts recommend regular dependency audits, prompt patch management, and close monitoring of GitHub issue trackers to stay ahead of similar supply‑chain threats.