Executive brief
Nextcloud Tables is an application used for organizing and managing structured data within the Nextcloud collaboration platform. A security vulnerability allows an authorized user to execute unauthorized database commands by entering specially crafted information into the app. This could allow an attacker to view sensitive private information or modify data they should not have access to, potentially compromising the integrity of the organization's records.
Technical details
A stored SQL injection vulnerability exists in the Nextcloud Tables app due to improper neutralization of the 'Column Type' parameter. An authenticated attacker with network access and low privileges can submit crafted input that is stored and later executed as part of an SQL command. While there is an initial 20-byte length limitation on the injection, researchers found that specific payloads can bypass this restriction to execute longer, more complex queries. This allows for unauthorized data extraction (Confidentiality) and data modification (Integrity). The issue is patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.
Affected products
- Nextcloud Tables 0.7.0 to < 0.7.7, 0.8.0 to < 0.8.10, 0.9.0 to < 0.9.8, 1.0.0 to < 1.0.4
Timeline
- 2026-02-12: patched: Initial code refactor and validation fixes merged in GitHub
- 2026-05-13: advisory: GitHub Security Advisory published by Nextcloud
- 2026-06-01: disclosed: CVE published to NVD dataset