Sign in

Nextcloud

Nextcloud for self-hosters: security advisories, Collabora CODE, hardening and keeping a private cloud patched and private.

1 articles
RSS

a rack of servers in a server room

Self Host Saturday

The Nextcloud Backdoor That Shipped as a Tidy-Up Commit

CVE-2026-110447 is a pre-auth command injection in Nextcloud's built-in Collabora CODE server, exploited since September and now in CISA KEV. The fix shipped a month earlier in a commit titled "tidy up how the coolwsd launch command is built," with no advisory. Disabling the app does not close it.