Permission bypass in DiskLruImageCacheFileProvider (GHSL-2021-1008)

Description

Impact

This issue may lead to sensitive information disclosure, in the case a thumbnail contains sensitive data (although the chances are low), even if the attacker app does not have the otherwise required MANAGE_DOCUMENTS permission.

Patches

It is recommended that the Nextcloud Android App is upgraded to 3.17.1.

Workarounds

None.

References

• HackerOne
• Commit

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com