Description
Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nextcloud | security-advisories | < 3.15 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nextcloud-desktop | 3.15.0-1 | — |
| Debian 13 | nextcloud-desktop | 3.15.0-1 | — |
| Debian 12 | nextcloud-desktop | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | nextcloud-desktop | No fix yet | — |
| Ubuntu 22.04 LTS | nextcloud-desktop | No fix yet | — |
| Ubuntu 20.04 LTS | nextcloud-desktop | No fix yet | — |
Advisories 1
- WID-SEC-2025-1082 Nextcloud: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2025