Nextcloud Server vulnerabilities

CVE-2019-15617 [MEDIUM] CWE-287 CVE-2019-15617: A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when tr A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.

CVE-2018-16465 [MEDIUM] CWE-287 CVE-2018-16465: Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at lo Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load.

CVE-2022-41970 [MEDIUM] CWE-284 CVE-2022-41970: Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disab Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked. Versions 24.0.7 and 25.0.1 contain a fix for this issue. No known workaroun

CVE-2020-8118 [MEDIUM] CWE-918 CVE-2020-8118: An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.

CVE-2019-15624 [MEDIUM] CWE-20 CVE-2019-15624: Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.

CVE-2023-25159 [MEDIUM] CWE-284 CVE-2023-25159: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform. Nextcloud Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, Nextcloud Enterprise Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, and Nextcloud Office (Richdocum

CVE-2016-9461 [MEDIUM] CWE-275 CVE-2016-9461: Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify exi

CVE-2019-15612 [MEDIUM] CWE-384 CVE-2019-15612: A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the pass A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.

CVE-2017-0890 [MEDIUM] CWE-79 CVE-2017-0890: Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerabilit Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

CVE-2021-32801 [MEDIUM] CWE-532 CVE-2021-32801: Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exce Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are ad

CVE-2020-8133 [MEDIUM] CWE-657 CVE-2020-8133: A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an a A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file.

CVE-2016-9462 [MEDIUM] CWE-275 CVE-2016-9462: Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore pri Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.

CVE-2021-32657 [MEDIUM] CWE-400 CVE-2021-32657: Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server p Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. The vulnerability is fixed in versions 19.0.11, 20.0.10, and

CVE-2020-8120 [MEDIUM] CWE-79 CVE-2020-8120: A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.

CVE-2020-8155 [MEDIUM] CWE-79 CVE-2020-8155: An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-sit An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.

CVE-2017-0893 [MEDIUM] CWE-79 CVE-2017-0893: Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library fo Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2. Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers.

CVE-2017-0891 [MEDIUM] CWE-79 CVE-2017-0891: Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of err Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components.

CVE-2022-24888 [MEDIUM] CWE-74 CVE-2022-24888: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Pri Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names,

CVE-2023-48304 [MEDIUM] CWE-639 CVE-2023-48304: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in ver Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, an attacker could ena

CVE-2025-47794 [MEDIUM] CWE-284 CVE-2025-47794: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0. Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink a