Executive brief
Nextcloud is an open-source platform used for file sharing and collaboration. A security flaw in the end-to-end encryption app allowed users with a valid 'file drop' link to upload files into other encrypted folders belonging to the same owner, rather than just the intended folder. While an attacker could place unauthorized files into these private areas, they could not read or modify any existing data.
Technical details
An authorization bypass (CWE-639) exists in the Nextcloud End-to-End Encryption (E2EE) app. The vulnerability stems from insufficient validation of the share structure for file-drop metadata. A malicious user with a valid E2EE file drop link can manipulate the target destination to upload files into other E2EE-protected folders owned by the same user. The attack requires network access and low privileges (possession of a share link), but does not permit the reading or modification of existing files. The issue is resolved in versions 1.15.4, 1.16.3, 1.17.1, 1.18.1, and 2.0.0-rc.7.
Affected products
- Nextcloud End-to-End Encryption app 1.15.0 to < 1.15.4, 1.16.0 to < 1.16.3, 1.17.0 to < 1.17.1, 1.18.0 to < 1.18.1
Timeline
- 2026-02-02: patched: Fix merged into master branch via Pull Request 1395
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-01: disclosed: CVE published to NVD