Nextcloud
Nextcloud Desktop: vulnerabilities and CVEs
Nextcloud Desktop has 27 published vulnerabilities, 1 of them in the last 12 months. 1 are rated critical and 0 are listed by CISA as actively exploited.
CVEs27
Last 12 months1
Critical1
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-66549 | Low (2.7) | 0.30% | — | Dec 5, 2025 | Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making… |
| CVE-2025-47792 | Medium (6.1) | 0.18% | — | May 16, 2025 | Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the… |
| CVE-2024-52510 | High (7.5) | 0.74% | — | Nov 15, 2024 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated… |
| CVE-2024-46958 | Critical (9.1) | 0.56% | — | Sep 16, 2024 | In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4. |
| CVE-2024-37885 | High (7.8) | 0.32% | — | Jun 14, 2024 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with… |
| CVE-2023-29000 | Medium (6.5) | 0.39% | — | Apr 4, 2023 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the… |
| CVE-2023-28999 | Medium (6.4) | 0.68% | — | Apr 4, 2023 | Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can… |
| CVE-2023-28998 | Medium (6.1) | 0.68% | — | Apr 4, 2023 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted… |
| CVE-2023-28997 | Medium (6.5) | 1.1% | — | Apr 4, 2023 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of… |
| CVE-2023-23942 | Medium (6.1) | 0.68% | — | Feb 6, 2023 | The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as… |
| CVE-2023-22472 | High (8.8) | 0.20% | — | Jan 9, 2023 | Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they… |
| CVE-2022-39333 | Medium (6.1) | 0.98% | — | Nov 25, 2022 | Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client is upgraded… |
| CVE-2022-39332 | Medium (5.4) | 0.98% | — | Nov 25, 2022 | Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the… |
| CVE-2022-39334 | Medium (4.7) | 0.21% | — | Nov 25, 2022 | Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates,… |
| CVE-2022-39331 | Medium (5.4) | 0.96% | — | Nov 25, 2022 | Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud… |
| CVE-2022-41882 | High (7.8) | 0.49% | — | Nov 11, 2022 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In version 3.6.0, if a user received a malicious file share and has it synced locally or the virtual filesystem… |
| CVE-2021-37617 | High (7.3) | 0.46% | — | Aug 18, 2021 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of… |
| CVE-2021-32728 | Medium (6.5) | 0.85% | — | Aug 18, 2021 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In… |
| CVE-2021-22895 | Medium (5.9) | 1.0% | — | Jun 11, 2021 | Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow. |
| CVE-2021-22879 | High (8.8) | 4.7% | — | Apr 14, 2021 | Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation. |
| CVE-2020-8225 | High (7.5) | 0.91% | — | Sep 18, 2020 | A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials. |
| CVE-2020-8227 | Medium (6.8) | 26% | — | Aug 21, 2020 | Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory. |
| CVE-2020-8189 | Medium (5.4) | 1.4% | — | Aug 21, 2020 | A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt. |
| CVE-2020-8230 | Medium (5.5) | 0.35% | — | Aug 17, 2020 | A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in for windows allowed to corrupt memory. |
| CVE-2020-8229 | Medium (5.5) | 0.47% | — | Aug 10, 2020 | A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system. |
| CVE-2020-8224 | High (7.8) | 0.66% | — | Aug 10, 2020 | A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory. |
| CVE-2020-8140 | Medium (6.7) | 0.69% | — | Mar 20, 2020 | A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the environment. |