Executive brief
Nextcloud is a platform used for storing and sharing files within organizations. A security flaw allows users who have been granted access to a file share to improperly view temporary data fragments being uploaded by the owner of that share. This could lead to the exposure of sensitive information while files are in the process of being uploaded.
Technical details
An improper access control vulnerability (CWE-284) exists in the WebDAV component of Nextcloud Server. When a user has a valid share token for a file or folder, they can leverage that token to directly access the chunking upload directory. This allows the malicious user to list and view intermediate/temporary file parts during an ongoing upload process by the share owner. The vulnerability is triggered by a failure to properly restrict access to intermediate files within the DAV service. Patches have been released for both Community and Enterprise editions to prevent the listing of these intermediate files.
Affected products
- Nextcloud Nextcloud Server 32.0.0 to 32.0.8, 33.0.0 to 33.0.2
- Nextcloud Nextcloud Enterprise Server 26.0.0 to 26.0.13.25, 27.0.0 to 27.1.11.24, 28.0.0 to 28.0.14.16, 29.0.0 to 29.0.16.15, 30.0.0 to 30.0.17.8, 31.0.0 to 31.0.14.4, 32.0.0 to 32.0.8, 33.0.0 to 33.0.2
Timeline
- 2026-04-22: patched: Fix merged into master branch
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-01: disclosed: NVD publication date