Executive brief
Nextcloud is a collaboration platform used for storing and sharing files. A security flaw allows certain users to bypass folder restrictions and copy sensitive system files into their own personal storage area. This could lead to the exposure of private data or configuration files, though it requires a specific configuration setting to be active and the attacker must have existing high-level access.
Technical details
A path traversal vulnerability (CWE-22) exists in Nextcloud Server's template API. The flaw is triggered when the '{lang}' placeholder is utilized within the 'templatedirectory' configuration value. An authenticated attacker with high privileges can exploit this to bypass directory restrictions and copy arbitrary files from the underlying server (subject to Unix file permissions) into their own Nextcloud user directory. The attack vector is network-based, but complexity is high as it requires a specific non-default configuration. Patches are available in Nextcloud Server versions 31.0.14 and 32.0.4, and various Enterprise Server maintenance releases.
Affected products
- Nextcloud Nextcloud Server 31.0.0 to < 31.0.14, 32.0.0 to < 32.0.4
- Nextcloud Nextcloud Enterprise Server 28.x < 28.0.14.15, 29.x < 29.0.17.12, 30.x < 30.0.17.7, 31.x < 31.0.14, 32.x < 32.0.4
Timeline
- 2025-12-17: other: Initial fix commit authored
- 2026-01-07: patched: Fix merged into master branch
- 2026-05-12: advisory: GitHub security advisory published
- 2026-06-01: disclosed: CVE published to NVD