CVE-2026-45722: Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the…

PriorityP343high7.1CVSS 3.1

AVNACLPRLUINSUCHINAL

EPSS

0.30%

21.7th percentile

Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or to make the database wait for a given time. This issue has been patched in versions 0.9.7 and 1.0.2.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
nextcloud	security-advisories	—	—
nextcloud	security-advisories	—	—
nextcloud	tables	>= 0.9.0 < 0.9.7	0.9.7
nextcloud	tables	>= 1.0.0 < 1.0.2	1.0.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.