File path disclosure of shared files in OfficeOnline application

Description

Impact

The Nextcloud OfficeOnline application did return verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file shared.txt is located within /files/$username/Myfolder/Mysubfolder/shared.txt)

Patches

It is recommended that the OfficeOnline application is upgraded to 1.1.1.

Workarounds

Disable the OfficeOnline application in the app settings.

References

• Pull Request

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com