Description
Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nextcloud | security-advisories | < 3.16.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nextcloud-desktop | 3.16.6-3 | — |
| Debian 13 | nextcloud-desktop | 3.16.6-3 | — |
| Debian 12 | nextcloud-desktop | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | nextcloud-desktop | No fix yet | — |
| Ubuntu 22.04 LTS | nextcloud-desktop | No fix yet | — |
| Ubuntu 20.04 LTS | nextcloud-desktop | No fix yet | — |
Advisories 1
- WID-SEC-2025-2752 Nextcloud: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 7, 2025