« Back to list

CVE-2026-45279

Status: AnalyzedMedium (6.5)—

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is upgraded to 32.0.4, 31.0.14. It is recommended that the Nextcloud Enterprise Server is upgraded to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Nextcloud — Nextcloud Server

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-45279",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45279",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T12:50:41.800240Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.7
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "nextcloud",
          "product": "security-advisories",
          "versions": [
            {
              "status": "affected",
              "version": ">= 31.0.0, < 31.0.14"
            },
            {
              "status": "affected",
              "version": ">= 32.0.0, < 32.0.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-01T19:16:49.980",
  "references": [
    {
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j33j-qph5-4wch",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextcloud/server/pull/57414/files",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://hackerone.com/reports/3468140",
      "tags": [
        "Permissions Required"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is upgraded to 32.0.4, 31.0.14. It is recommended that the Nextcloud Enterprise Server is upgraded to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15"
    },
    {
      "lang": "es",
      "value": "Nextcloud es una plataforma de colaboración de contenido de código abierto. En Nextcloud Server desde las versiones 31.0.0 hasta antes de la 31.0.14, y 32.0.0 hasta antes de la 32.0.4, si se usa {lang} en el valor de configuración del directorio de plantillas, los usuarios no administradores pueden en algunos casos copiar archivos arbitrarios (dependiendo de los permisos unix) en su propio directorio de Nextcloud a través de un salto de ruta. Se recomienda que el Nextcloud Server se actualice a 32.0.4, 31.0.14. Se recomienda que el Nextcloud Enterprise Server se actualice a 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15"
    }
  ],
  "lastModified": "2026-07-22T07:10:00.107",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BB62148-4EB3-44D6-A11A-2D6581A0026C",
              "versionEndExcluding": "31.0.14",
              "versionStartIncluding": "31.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A405D27F-8E95-45A5-9174-99E60586700C",
              "versionEndExcluding": "32.0.4",
              "versionStartIncluding": "32.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74D4EB7C-A643-4B77-ABC8-E882F5A9A454",
              "versionEndExcluding": "28.0.14.15",
              "versionStartIncluding": "28.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BB07BC2-B8A0-4E3B-AEFF-AFBA6FE3C7C0",
              "versionEndExcluding": "29.0.17.12",
              "versionStartIncluding": "29.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63869F64-1B12-478D-B7E7-98EBE07FFD57",
              "versionEndExcluding": "30.0.17.7",
              "versionStartIncluding": "30.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27783B45-4DFD-443E-98A9-6531E8AEE962",
              "versionEndExcluding": "31.0.14",
              "versionStartIncluding": "31.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41E1AD78-E1DD-4C0F-A346-5E8C31C12766",
              "versionEndExcluding": "32.0.4",
              "versionStartIncluding": "32.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}