Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial of Service zu verursachen und Informationen offenzulegen.
Product
Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit.
Vulnerabilities 3
-
High 7.1
Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER B…
-
Medium 6.8
Nextcloud: Propfind requests for file comments allowed to load comments for other files
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content…
-
Medium 5.9
Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-…
Revision history
-
#1
Initiale Fassung
References
-
Nextcloud Security Advisory vom 2026-06-01
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jgcj-v42r-9922
-
Nextcloud Security Advisory vom 2026-06-01
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5h2w-c7px-hp4j
-
Nextcloud Security Advisory vom 2026-06-01
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-285v-p9x9-cjhj