Nextcloud Server (Nextcloud) - vulnerabilities (CVEs)

189 CVEs, 0 in the last 30 days, 1624 known versions, newest CVE from 2026-06-01. Vendor: Nextcloud.

CVEs of Nextcloud Server

CVE-2026-45810 - CVSS 6.8 (medium), 2026-06-01: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing…
CVE-2026-45691 - CVSS 5.9 (medium), 2026-06-01: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA…
CVE-2026-45690 - CVSS 5.9 (medium), 2026-06-01: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an…
CVE-2026-45281 - CVSS 8.1 (high), 2026-06-01: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the…
CVE-2026-45285 - CVSS 6.4 (medium), 2026-06-01: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or…
CVE-2026-45283 - CVSS 6.3 (medium), 2026-06-01: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the…
CVE-2026-45282 - CVSS 6.5 (medium), 2026-06-01: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an…
CVE-2026-45279 - CVSS 6.5 (medium), 2026-06-01: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang}…
CVE-2025-64011 - CVSS 4.3 (medium), 2025-12-12: Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews…
CVE-2025-66552 - CVSS 4.3 (medium), 2025-12-05: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with…
CVE-2025-66547 - CVSS 4.3 (medium), 2025-12-05: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on…
CVE-2025-66512 - CVSS 6.1 (medium), 2025-12-05: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed…
CVE-2025-66510 - CVSS 4.9 (medium), 2025-12-05: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11,…
CVE-2025-59788 - CVSS 6.4 (medium), 2025-12-04: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29,…
CVE-2025-47794 - CVSS 4.3 (medium), 2025-05-16: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to…
CVE-2025-47793 - CVSS 6.5 (medium), 2025-05-16: Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or…
CVE-2025-47791 - CVSS 5.3 (medium), 2025-05-16: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to…
CVE-2025-47790 - CVSS 6.4 (medium), 2025-05-16: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to…
CVE-2024-52513 - CVSS 4.3 (medium), 2024-11-15: Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to…
CVE-2024-52514 - CVSS 4.1 (medium), 2024-11-15: Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the…
CVE-2024-52525 - CVSS 7.5 (high), 2024-11-15: Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The…
CVE-2024-52521 - CVSS 5.3 (medium), 2024-11-15: Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a…
CVE-2024-52520 - CVSS 6.5 (medium), 2024-11-15: Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading…
CVE-2024-52523 - CVSS 6.5 (medium), 2024-11-15: Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API…
CVE-2024-52518 - CVSS 5.4 (medium), 2024-11-15: Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to…
CVE-2024-52517 - CVSS 5.9 (medium), 2024-11-15: Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the…
CVE-2024-52516 - CVSS 4.3 (medium), 2024-11-15: Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a…
CVE-2024-52519 - CVSS 8.2 (high), 2024-11-15: Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a…
CVE-2024-52515 - CVSS 6.5 (medium), 2024-11-15: Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a…
CVE-2024-37887 - CVSS 3.5 (low), 2024-06-14: Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that…
CVE-2024-37884 - CVSS 5.4 (medium), 2024-06-14: Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with…
CVE-2024-37882 - CVSS 8.1 (high), 2024-06-14: Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It…
CVE-2024-37315 - CVSS 4.3 (medium), 2024-06-14: Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the…
CVE-2024-37314 - CVSS 3.5 (low), 2024-06-14: Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is…
CVE-2024-37313 - CVSS 7.5 (high), 2024-06-14: Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully…
CVE-2024-22403 - CVSS 3.7 (low), 2024-01-18: Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an…
CVE-2023-49792 - CVSS 9.8 (critical), 2023-12-22: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as…
CVE-2023-49791 - CVSS 5.4 (medium), 2023-12-22: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as…
CVE-2023-48306 - CVSS 9.8 (critical), 2023-11-21: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and…
CVE-2023-48305 - CVSS 4.4 (medium), 2023-11-21: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and…
CVE-2023-48304 - CVSS 4.3 (medium), 2023-11-21: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and…
CVE-2023-48303 - CVSS 2.7 (low), 2023-11-21: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and…
CVE-2023-48302 - CVSS 5.4 (medium), 2023-11-21: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and…
CVE-2023-48301 - CVSS 5.4 (medium), 2023-11-21: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and…
CVE-2023-48239 - CVSS 8.5 (high), 2023-11-21: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and…
CVE-2023-45151 - CVSS 8.8 (high), 2023-10-16: Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has…
CVE-2023-45148 - CVSS 4.3 (medium), 2023-10-16: Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset…
CVE-2023-39960 - CVSS 7.5 (high), 2023-10-13: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as…
CVE-2023-39959 - CVSS 5.3 (medium), 2023-08-10: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and…
CVE-2023-39963 - CVSS 8.1 (high), 2023-08-10: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13,…
CVE-2023-39962 - CVSS 7.7 (high), 2023-08-10: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15,…
CVE-2023-39961 - CVSS 4.3 (medium), 2023-08-10: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and…
CVE-2023-39958 - CVSS 5.8 (medium), 2023-08-10: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8,…
CVE-2023-39952 - CVSS 6.5 (medium), 2023-08-10: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8,…
CVE-2023-35928 - CVSS 8.8 (high), 2023-06-23: Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0…
CVE-2023-35171 - CVSS 6.1 (medium), 2023-06-23: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior…
CVE-2023-35927 - CVSS 8.1 (high), 2023-06-23: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0…
CVE-2023-35172 - CVSS 9.1 (critical), 2023-06-23: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0…
CVE-2023-32320 - CVSS 8.7 (high), 2023-06-22: Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were…
CVE-2023-32319 - CVSS 8.1 (high), 2023-05-26: Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to…
CVE-2023-32318 - CVSS 7.2 (high), 2023-05-26: Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct…
CVE-2023-28847 - CVSS 7.5 (high), 2023-04-25: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior…
CVE-2023-30539 - CVSS 8.8 (high), 2023-04-17: Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to…
CVE-2023-28834 - CVSS 4.3 (medium), 2023-04-03: Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server…
CVE-2023-28844 - CVSS 6.5 (medium), 2023-03-31: Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an…
CVE-2023-28835 - CVSS 7.5 (high), 2023-03-30: Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak…
CVE-2023-28644 - CVSS 7.5 (high), 2023-03-30: Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server…
CVE-2023-28643 - CVSS 8.8 (high), 2023-03-30: Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache…
CVE-2023-26482 - CVSS 9.1 (critical), 2023-03-30: Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are…
CVE-2023-28833 - CVSS 8.8 (high), 2023-03-30: Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided…
CVE-2023-25817 - CVSS 8.1 (high), 2023-03-27: Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete…
CVE-2023-25818 - CVSS 7.1 (high), 2023-03-27: Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and…
CVE-2023-25820 - CVSS 7.8 (high), 2023-03-22: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of…
CVE-2023-25821 - CVSS 7.5 (high), 2023-02-25: Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access…
CVE-2023-25816 - CVSS 6.5 (medium), 2023-02-25: Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can…
CVE-2023-25579 - CVSS 7.5 (high), 2023-02-22: Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing…
CVE-2023-25162 - CVSS 5.3 (medium), 2023-02-13: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud…
CVE-2023-25161 - CVSS 5.3 (medium), 2023-02-13: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to…
CVE-2023-25159 - CVSS 5.3 (medium), 2023-02-13: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the…
CVE-2022-41969 - CVSS 2.7 (low), 2022-12-01: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a…
CVE-2022-41968 - CVSS 5.3 (medium), 2022-12-01: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a…
CVE-2022-41970 - CVSS 5.3 (medium), 2022-12-01: Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview…
CVE-2022-39346 - CVSS 6.5 (medium), 2022-11-25: Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a…
CVE-2022-39364 - CVSS 6.5 (medium), 2022-10-27: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and…
CVE-2022-39330 - CVSS 4.8 (medium), 2022-10-27: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and…
CVE-2022-39329 - CVSS 5.3 (medium), 2022-10-27: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to…
CVE-2022-39211 - CVSS 5.3 (medium), 2022-09-16: Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested…
CVE-2022-36074 - CVSS 7.5 (high), 2022-09-15: Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the…
CVE-2022-31118 - CVSS 6.5 (medium), 2022-08-04: Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and…
CVE-2022-31120 - CVSS 2.7 (low), 2022-08-04: Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In…
CVE-2022-31014 - CVSS 5.4 (medium), 2022-07-05: Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on…
CVE-2022-29243 - CVSS 4.3 (medium), 2022-05-31: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size…
CVE-2022-29163 - CVSS 4.3 (medium), 2022-05-20: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link…
CVE-2022-24889 - CVSS 4.3 (medium), 2022-04-27: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible…
CVE-2022-24888 - CVSS 4.3 (medium), 2022-04-27: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it…
CVE-2021-41233 - CVSS 6.5 (medium), 2022-03-10: Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which…
CVE-2022-24741 - CVSS 6.5 (medium), 2022-03-09: Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading…
CVE-2021-41241 - CVSS 4.3 (medium), 2022-03-08: Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a…
CVE-2021-41239 - CVSS 5.3 (medium), 2022-03-08: Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user…
CVE-2021-41177 - CVSS 8.1 (high), 2021-10-25: Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database…