Lucene search

K
hackeroneJuliushaertlH1:1745766
HistoryOct 21, 2022 - 1:59 p.m.

Nextcloud: Disabled download shares still allow download through preview images

2022-10-2113:59:15
juliushaertl
hackerone.com
14
nextcloud
unauthorized downloads
preview images
security issue
bug bounty

0.001 Low

EPSS

Percentile

31.0%

Summary:

Steps To Reproduce:

  1. Share a folder and disable the “Allow download” permission
  2. Now as the recipient of the file you can still download the preview of the file

This is an issue for images but also for shared documents where viewing them in Collabora would present them watermarked but the preview would leak the first page without an watermark.

Impact

Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked.

0.001 Low

EPSS

Percentile

31.0%