Attackers have reportedly exploited a vulnerability in an optional Nextcloud component, the Collabora Online - Built-in CODE Server app, to install web shells on servers. For organisations using self-hosted Nextcloud for file sharing, document collaboration or internal portals, the issue is relevant because a successful compromise can give attackers remote command execution on the affected system.

What happened

According to reports referenced in the source, attackers abused a flaw in the optional Collabora Online - Built-in CODE Server app for Nextcloud. The attacks were said to result in the deployment of web shells, which are small server-side files that allow an attacker to send commands to the compromised server over web requests.

The source states that three administrators reported the issue on GitHub, and that the first logged attack was recorded on 10 September. Based on the information available, the activity appears to affect environments where the optional Collabora component was installed, rather than all Nextcloud deployments by default.

At the time reflected by the source, the key confirmed point for businesses is that attackers were not merely scanning for the flaw but were reportedly using it in real incidents.

Why it matters for European businesses

Nextcloud is widely used by organisations that want greater control over data hosting, collaboration and document workflows. That makes this issue particularly relevant for European businesses, public-sector suppliers and regulated organisations that prefer self-hosted or sovereign cloud setups.

If a web shell is installed successfully, an attacker may be able to execute commands with the permissions of the web server account. In practice, that can create several business risks:

• Data exposure: files, shared documents and configuration data stored on or accessible from the server may be at risk.
• Persistence: a web shell can allow attackers to return later, even after an initial intrusion is noticed.
• Lateral movement: compromised collaboration infrastructure can become a path into connected systems, storage or internal applications.
• Operational disruption: document collaboration, internal file access and customer-facing portals built on Nextcloud may be interrupted during investigation and recovery.

For SMEs, the practical concern is that collaboration systems are often treated as business utilities and may not receive the same hardening and monitoring as core production systems. An optional app inside a trusted platform can therefore become an overlooked entry point.

Who may be affected

The issue is most relevant to organisations that:

• run self-hosted Nextcloud environments;
• have installed the Collabora Online - Built-in CODE Server app;
• expose Nextcloud instances to the public internet;
• use Nextcloud for sensitive internal documents, customer files or regulated data workflows;
• rely on MSPs, hosting partners or internal IT teams to maintain collaboration infrastructure.

Businesses using hosted services should still check with their provider, but the reported issue specifically concerns the optional app in affected Nextcloud environments rather than every cloud collaboration service more broadly.

What companies should consider

Businesses using Nextcloud should review whether the optional Collabora built-in CODE app is installed and whether their environment has received any vendor-recommended updates, mitigations or configuration changes related to this issue.

• Identify exposure: confirm whether the affected optional app is enabled in any production, staging or legacy Nextcloud instance.
• Check for compromise: review web server directories, logs and administrative changes for indicators such as unexpected files, suspicious requests or unknown scheduled tasks.
• Apply vendor guidance: follow official updates from Nextcloud and Collabora, and avoid relying on third-party mitigation advice unless validated internally.
• Restrict access where possible: limit unnecessary internet exposure, administrative access and app installation permissions.
• Prepare incident response steps: if compromise is suspected, isolate the server, preserve logs, rotate credentials and review connected systems for follow-on activity.

For European organisations with compliance obligations, a server compromise involving collaboration data may also trigger internal legal, contractual or breach-assessment processes. Companies should therefore treat this as more than a routine patching issue if evidence of intrusion is found.