Potential directory traversal in OC\Files\Node\Folder::getFullPath

Description

Impact

OC\Files\Node\Folder::getFullPath() is validating and normalizing the string in the wrong order.

The function seems to be used in newFile() and newFolder() items, allowing to create paths outside of ones own space and overwriting data from other users.

Patches

It is recommended that the Nextcloud Server is upgraded to 25.0.2, 24.0.8, 23.0.12,
It is recommended that the Nextcloud Enterprise Server is upgraded to 25.0.2, 24.0.8, 23.0.12, 22.2.10.10, 21.0.9.10, 20.0.14.12

Workarounds

No workaround available

References

• HackerOne
• PullRequest

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com