Collabora warns disabling vulnerable Nextcloud app does not stop attacks
Image: Primary Collabora published an advisory Wednesday warning that an exploited flaw in its optional Nextcloud Built-in CODE Server app requires an update or removal; disabling the app does not close the vulnerability. Versions before 26.4.303 allow unauthenticated commands when the app's local document server is down, including during restarts or crashes.
Administrators reported attackers planting files that execute commands through web requests. The fix shipped September 11, but requires Nextcloud 30 or later. Users on Nextcloud 29 or older must upgrade Nextcloud or remove the app. Standalone Collabora Online servers are unaffected.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
