Summary
Ein Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.
Product
Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit.
Vulnerabilities 4
-
Medium 5.4
Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permi…
-
Low 3.5
Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and…
-
Low 3.5
Nextcloud talk allows participants to blindly delete poll drafts of other users by ID
Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fix…
-
Low 3.1
Nextcloud Twofactor WebAuthn app was updated based on public key
Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-away a 2FA webauthn device when correctly guessing a 80-128 character long random string of letters, …
Revision history
-
#1
Initiale Fassung
References
-
Nextcloud Security Advisory vom 2025-12-07
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pr9f-vqgg-m2jh
-
Nextcloud Security Advisory vom 2025-12-07
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fr8x-mvjg-wf9q
-
Nextcloud Security Advisory vom 2025-12-07
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9v78-cpfc-v6h2
-
Nextcloud Security Advisory vom 2025-12-07
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wwr8-hx9g-rjvv