The Nextcloud Backdoor That Shipped as a Tidy-Up Commit

CVE-2026-110447 is a pre-auth command injection in Nextcloud's built-in Collabora CODE server, exploited since September and now in CISA KEV. The fix shipped a month earlier in a commit titled "tidy up how the coolwsd launch command is built," with no advisory. Disabling the app does not close it.

Read the full article →

Discussion thread — share findings, corrections and follow-ups below.