← Back

CVE-2026-45279

nvd nist
Published: Jun 1, 2026Modified: Jul 22, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is upgraded to 32.0.4, 31.0.14. It is recommended that the Nextcloud Enterprise Server is upgraded to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15

Affected (7)

Nextcloud
1 product
Nextcloud Server
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Nextcloud
Nextcloud Server
From 31.0.0 to 31.0.14
Nextcloud Server
From 32.0.0 to 32.0.4
Configuration B
5 vulnerable
Vulnerable SoftwareAffected Versions
Nextcloud
Nextcloud Server
From 28.0.0 to 28.0.14.15
Nextcloud Server
From 29.0.0 to 29.0.17.12
Nextcloud Server
From 30.0.0 to 30.0.17.7
Nextcloud Server
From 31.0.0 to 31.0.14
Nextcloud Server
From 32.0.0 to 32.0.4

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

Source: security-advisories@github.com
MitigationVendor Advisory
Source: security-advisories@github.com
Issue TrackingPatch
Source: security-advisories@github.com
Permissions Required

Timeline

No history available yet.