Collabora said in a security advisory that its Built-in CODE Server app for Nextcloud has a flaw. A crafted web request can run an operating system command with the rights of the web server account. The Hacker News reported that attackers used this to plant web shells, small files that run any command sent to them. Three administrators reported attacks on GitHub, and the first logged one was on September 10.
Collabora said the attack works only while the app's built-in server is down, such as after a restart, upgrade or crash. Turning the app off does not help. It must be updated to 26.4.303 or later, or removed. Standalone Collabora Online servers are not affected, Collabora said. The Hacker News said the fix came on September 11. One administrator found no commands that copied files out, but said anything the web server can read may be exposed. The sources do not say who is behind the attacks or how many servers were hit.
Teams running Nextcloud with this app should check the installed version. Nextcloud 29 and older are no longer supported, so Collabora says those users must upgrade Nextcloud or remove the app. The Hacker News noted that the app's store listing calls it meant for local testing and non-production use.