PT-2026-45536 · Nextcloud · Nextcloud

Dorra Jaouad · CVE-2026-45722 · Published 2026-06-01 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud versions 0.9.0 through 0.9.6 Nextcloud versions 1.0.0 through 1.0.1

Description Missing sanitization in the Tables app allows a user with access to the application to perform a limited SQL injection within the ORDER BY statement of a query. This specific type of injection is restricted to extracting a single bit of information per request or inducing a time delay in the database response.

Recommendations Update Nextcloud versions 0.9.0 through 0.9.6 to version 0.9.7. Update Nextcloud versions 1.0.0 through 1.0.1 to version 1.0.2.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-45722

GHSA-5H2W-C7PX-HP4J

Affected Products

Nextcloud

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45722.json · Exploit
• https://github.com/nextcloud/tables/pull/2186 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5h2w-c7px-hp4j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45722 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45722 · Vendor Advisory
• https://t.me/cveNotify/211624 · Telegram Post
• https://hackerone.com/reports/3446689 · Note