Nextcloud
Nextcloud Desktop: vulnerabilidades y CVE
Nextcloud Desktop tiene 27 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE27
Últimos 12 meses1
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-66549 | Baja (2.7) | 0.30% | — | 5 dic 2025 | Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making… |
| CVE-2025-47792 | Media (6.1) | 0.18% | — | 16 may 2025 | Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the… |
| CVE-2024-52510 | Alta (7.5) | 0.74% | — | 15 nov 2024 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated… |
| CVE-2024-46958 | Crítica (9.1) | 0.56% | — | 16 sept 2024 | In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4. |
| CVE-2024-37885 | Alta (7.8) | 0.32% | — | 14 jun 2024 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with… |
| CVE-2023-29000 | Media (6.5) | 0.39% | — | 4 abr 2023 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the… |
| CVE-2023-28999 | Media (6.4) | 0.68% | — | 4 abr 2023 | Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can… |
| CVE-2023-28998 | Media (6.1) | 0.68% | — | 4 abr 2023 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted… |
| CVE-2023-28997 | Media (6.5) | 1.1% | — | 4 abr 2023 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of… |
| CVE-2023-23942 | Media (6.1) | 0.68% | — | 6 feb 2023 | The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as… |
| CVE-2023-22472 | Alta (8.8) | 0.20% | — | 9 ene 2023 | Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they… |
| CVE-2022-39333 | Media (6.1) | 0.98% | — | 25 nov 2022 | Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client is upgraded… |
| CVE-2022-39332 | Media (5.4) | 0.98% | — | 25 nov 2022 | Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the… |
| CVE-2022-39334 | Media (4.7) | 0.21% | — | 25 nov 2022 | Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates,… |
| CVE-2022-39331 | Media (5.4) | 0.96% | — | 25 nov 2022 | Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud… |
| CVE-2022-41882 | Alta (7.8) | 0.49% | — | 11 nov 2022 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In version 3.6.0, if a user received a malicious file share and has it synced locally or the virtual filesystem… |
| CVE-2021-37617 | Alta (7.3) | 0.46% | — | 18 ago 2021 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of… |
| CVE-2021-32728 | Media (6.5) | 0.85% | — | 18 ago 2021 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In… |
| CVE-2021-22895 | Media (5.9) | 1.0% | — | 11 jun 2021 | Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow. |
| CVE-2021-22879 | Alta (8.8) | 4.7% | — | 14 abr 2021 | Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation. |
| CVE-2020-8225 | Alta (7.5) | 0.91% | — | 18 sept 2020 | A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials. |
| CVE-2020-8227 | Media (6.8) | 26% | — | 21 ago 2020 | Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory. |
| CVE-2020-8189 | Media (5.4) | 1.4% | — | 21 ago 2020 | A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt. |
| CVE-2020-8230 | Media (5.5) | 0.35% | — | 17 ago 2020 | A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in for windows allowed to corrupt memory. |
| CVE-2020-8229 | Media (5.5) | 0.47% | — | 10 ago 2020 | A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system. |
| CVE-2020-8224 | Alta (7.8) | 0.66% | — | 10 ago 2020 | A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory. |
| CVE-2020-8140 | Media (6.7) | 0.69% | — | 20 mar 2020 | A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the environment. |