The Nextcloud Backdoor That Shipped as a Tidy-Up Commit
- Created
- 14 Nov 2026
- Last reply
- about 12 hours ago
- Replies
- 0
- Views
- 0
- Reactions
- 0
Discussion of the blog article The Nextcloud Backdoor That Shipped as a Tidy-Up Commit.
CVE-2026-110447 is a pre-auth command injection in Nextcloud's built-in Collabora CODE server, exploited since September and now in CISA KEV. The fix shipped a month earlier in a commit titled "tidy up how the coolwsd launch command is built," with no advisory. Disabling the app does not close it.
Discussion thread — share findings, corrections and follow-ups below.