CVE-2020-8293

CVE-2020-8293 : A missing input validation in Nextcloud Server allowed users to store unlimited data in workflow rules, causing load and potential DDoS on subsequent interactions. Affected versions were 18.0.x, 19.0.x, and 20.0.x prior to fixes. Connectedupdates show Nextcloud releases addressing...

CVE-2021-32733

CVE-2021-32733 relates to Nextcloud Text (Nextcloud Server) where a cross-site scripting vulnerability exists in Nextcloud Text prior to 21.0.3, caused by serving files with a text/html Content-Type. The issue is mitigated by Content-Security-Policy in modern browsers but was fixed in Nextcloud T...

CVE-2019-15621

Nextcloud Server 16.0.1 is affected by CVE-2019-15621: an improper permissions preservation enables sharees to reshare with write permissions when sharing the mount point of a received share via a public link. Root cause is a permissions preservation flaw in the sharing flow; exploitation details...

CVE-2020-8139

CVE-2020-8139 affects Nextcloud Server versions older than 18.0.1, 17.0.4 and 16.0.9, where a missing access control check allows hide-download shares to be downloaded when the URL is appended with /download. Connected documents confirm this is a remote access control vulnerability with potential...

CVE-2020-8138

CVE-2020-8138: Nextcloud Server is vulnerable to a Server-Side Request Forgery (SSRF) when subscribing to a malicious calendar URL due to a missing check for IPv4 nested inside IPv6. Affected versions are Nextcloud Server < 17.0.1, < 16.0.7, and

CVE-2022-24741

CVE-2022-24741 affects Nextcloud Server and describes a denial-of-service vulnerability caused by uploading specially crafted files that trigger excessive memory/CPU usage during processing (notably previews). Public references specify affected Nextcloud Server variants and recommend upgrading to...

CVE-2021-41233

CVE-2021-41233 concerns Nextcloud Server where the default Nextcloud Text app contains an issue allowing an attacker to access the folder names in the “File Drop” area. Exploitation requires knowledge of a sharing link. Affected context and guidance across connected sources indicate upgrading Nex...

CVE-2025-47790

Nextcloud Server and Enterprise Server are affected by a session-handling bug that can skip the second-factor authentication after a successful login when remember_login_cookie_lifetime is set to 0 and the session times out. Affected versions: Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3...

CVE-2022-31118

This CVE affects Nextcloud Server federated sharing. Affected: Nextcloud Server versions vulnerable to brute-forcing to detect federated sharing and potentially brute-force access tokens for federated shares. Root cause: insufficient brute-force protection for federated sharing, enabling exploita...

CVE-2024-52523

CVE-2024-52523 affects Nextcloud Server. When a user or administrator defines external storage with fixed credentials, the API returns those credentials and re-inserts them into the frontend, allowing an attacker with an active user session to read them in plain text. The vulnerability enables in...

CVE-2025-66512

Nextcloud Server and Server Enterprise before 31.0.12 and 32.0.3 have a missing sanitization that can be exploited to bypass content security policy when a user is tricked into viewing a crafted SVG outside the Nextcloud UI, enabling cross-site scripting. Fedora advisories FEDORA-2025-86c0829159 ...

CVE-2022-39346

CVE-2022-39346 affects Nextcloud Server. Affected versions did not properly limit user display names, which could allow a malicious user to overload the backing database and trigger a denial of service. OpenSUSE advisory confirms the issue and attributes exploitation to missing length validation ...

CVE-2024-52515

The CVE-2024-52515 entry concerns Nextcloud Server where, after an admin enables the default-disabled SVG preview provider, a malicious user could upload an SVG file that references paths, causing the preview to render another file’s contents. Technical details across connected sources confirm th...

CVE-2023-39952

CVE-2023-39952 affects Nextcloud Server: a user could access files inside a subfolder of a groupfolder despite advanced permissions. Affected are Nextcloud Server versions starting at 22.0.0 up to but not including the patches listed for 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0....

CVE-2021-22877

CVE-2021-22877 affects Nextcloud Server prior to 20.0.6, where a missing user check can cause a user’s own credentials to be populated for other users’ external storage configuration when that configuration has not yet been set. This is documented across multiple sources (NVD entry, CNVD/CNNVD su...

CVE-2016-9459

CVE-2016-9459 affects Nextcloud Server < 9.0.52 and ownCloud Server

CVE-2023-28844

CVE-2023-28844 affects Nextcloud Server; an access-control error allows users who should not download a file to retrieve an older version and distribute it. Affected versions were prior to 24.0.10 and prior to 25.0.4. The issue is mitigated by upgrading to Nextcloud Server 24.0.10 or 25.0.4 (or l...

CVE-2020-8120

CVE-2020-8120 describes a reflected XSS in Nextcloud Server 16.0.1 related to SVG logo generation. The issue affects the SVG rendering path (logo) via user-controllable inputs and has a CVSS v3.1 base score of 6.1 (MEDIUM). Public references (NVD/CVE records and Nextcloud advisory) confirm the vu...

CVE-2017-0883

CVE-2017-0883 affects Nextcloud Server before 9.0.55 and 10.0.2, where a permission escalation in the OCS sharing API allows an authenticated user to reshare items with elevated permissions. The issue enables an attacker to edit files in a share despite having only read access for folders/files t...

CVE-2024-52520

The CVE-2024-52520 entries describe a vulnerability in Nextcloud Server where a pre-flighted HEAD request allows the link reference provider to be tricked into downloading larger websites than intended to extract open-graph data. Affected software includes Nextcloud Server and Enterprise Server w...

CVE-2023-35171

CVE-2023-35171 affects Nextcloud Server and Nextcloud Enterprise Server, with the issue present from 26.0.0 up to, but not including, 26.0.2. An attacker could craft a URL that redirects a victim from a legitimate domain to the attacker’s site, enabling phishing-like behavior. A fix is available ...

CVE-2025-47793

The CVE-2025-47793 issue affects Nextcloud Server and the Groupfolders app where, due to missing quota enforcement on attachments, logged-in users could upload files that exceed the group folder quota. Affected versions and fixes are: Nextcloud Server: before 30.0.2, 29.0.9, 28.0.1 Nextcloud Ente...

CVE-2026-45810

Summary: CVE-2026-45810 affects Nextcloud Server, where a missing relation check allows authenticated users with access to any file comment to read the content of all comments. Affected versions are 31.0.0–31.0.11 and 32.0.0–32.0.2; fixed in 31.0.12 and 32.0.3. Enterprise Server upgrades are prov...

CVE-2022-39364

CVE-2022-39364 affects Nextcloud Server and Enterprise Server: reading nextcloud.log can reveal credentials to connect to a SharePoint service. Affected versions include Nextcloud Server prior to 23.0.9 and prior to 24.0.5; Nextcloud Enterprise Server prior to 22.2.10.5, 23.0.9, and 24.0.5. Patch...

CVE-2026-45282

This CVE affects Nextcloud Server versions 32.0.0–32.0.8 and 33.0.0–33.0.2, where an authenticated attacker can access attachments of link shares using a valid share token and a known documentId, bypassing password protection or download restrictions. The vulnerability enables access to attachmen...

CVE-2023-25816

CVE-2023-25816 – Nextcloud resource consumption : The issue affects Nextcloud Server 25.0.0 through versions before 25.0.3, where an extremely long password can cause uncontrolled resource usage during validation. This vulnerability is addressed by upgrading to 25.0.3, as stated in the advisory a...

CVE-2020-8236

Nextcloud Server 19.0.1 contains an improper authentication issue where a misconfiguration causes a passwordless WebAuthn PIN to be treated as two-factor authentication, but the PIN is not actually verified. This vulnerability could lead to users believing they have 2FA protection when the system...

CVE-2020-8223

CVE-2020-8223 affects Nextcloud Server 19.0.0 and is described as a logic error enabling privilege escalation by reshare with higher permissions than the attacker’s own. Fedora advisories show a fix in Nextcloud 19.0.3 (NC-SA-2020-029), and OpenVAS/NVD entries corroborate the CVE, but exploitatio...

CVE-2020-8296

Summary of CVE-2020-8296 (Nextcloud Server) : Multiple sources describe Nextcloud Server versions prior to 20.0.0 as storing passwords in a recoverable format even when external storage is not configured. The issue is associated with Nextcloud Server

CVE-2026-45279

Nextcloud Server versions 31.0.0–31.0.13 and 32.0.0–32.0.3 are affected when {lang} is used in the template directory config value. Non-admin users can in some cases copy arbitrary files into their own Nextcloud directory via a path traversal, depending on Unix permissions. Impact is described as...

CVE-2016-9466

CVE-2016-9466 is a reflected XSS in the Gallery application affecting Nextcloud Server before 10.0.1 and ownCloud Server before 9.0.6, with further versions 9.1.2 affected. The issue arises from the Gallery app not properly sanitizing exception messages generated by the Nextcloud/ownCloud server;...

CVE-2017-0886

CVE-2017-0886 affects Nextcloud Server. The vulnerability stems from an error in the application logic that allows an authenticated adversary to trigger an endless recursion, resulting in a Denial of Service. Impact is described as Denial of Service with potential for persistent unavailability. A...

CVE-2026-45285

Concretely affected software: Nextcloud server branches 32.x (32.0.0–32.0.8) and 33.x (33.0.0–33.0.2). The vulnerability arises when sharing with a Team that includes an external member; a public link is auto-created for that external member and is not shown in the share UI. The link grants the s...

CVE-2025-59788

Technical details about CVE-2025-59788 are not publicly available in the connected documents provided. The materials summarize Nextcloud XSS in a reachable files_pdfviewer directory and list affected versions, but no further technical specifics, root cause, impact, or remediation are included her...

CVE-2026-45283

In Nextcloud Server, the files_lock app is vulnerable in versions 32.0.0 to before 32.0.2 and 33.0.0 to before 33.0.1. The root cause is improper validation of file ownership when processing DAV lock and unlock requests, allowing an authenticated user to lock or unlock files belonging to other us...