PT-2026-45473 · Nextcloud · Nextcloud Server+1
CVSS v3.1
6.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Nextcloud Server versions 32.0.0 through 32.0.8
Nextcloud Server versions 33.0.0 through 33.0.2
Nextcloud Enterprise Server versions prior to 26.0.13.26
Nextcloud Enterprise Server versions prior to 27.1.11.25
Nextcloud Enterprise Server versions prior to 28.0.14.17
Nextcloud Enterprise Server versions prior to 29.0.16.16
Nextcloud Enterprise Server versions prior to 30.0.17.9
Nextcloud Enterprise Server versions prior to 31.0.14.5
Nextcloud Enterprise Server versions prior to 32.0.9
Nextcloud Enterprise Server versions prior to 33.0.3
Description
An issue exists in the content collaboration platform where a malicious user with access to a file share can utilize the share token to directly access chunking uploads. This allows the attacker to view temporary part files while uploads are ongoing.
Recommendations
Upgrade Nextcloud Server versions 32.0.0 through 32.0.8 to 32.0.9.
Upgrade Nextcloud Server versions 33.0.0 through 33.0.2 to 33.0.3.
Upgrade Nextcloud Enterprise Server to 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9, or 33.0.3.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nextcloud Enterprise Server
Nextcloud Server