Executive brief
Nextcloud is an open-source collaboration platform, and its Tables app allows users to manage structured data. A security flaw in the Tables app allows an authorized user to perform a limited SQL injection attack. While the attack is restricted in scope, it could be used to slowly extract sensitive information from the database or cause performance delays, potentially impacting data confidentiality and system responsiveness.
Technical details
A SQL injection vulnerability exists in the Nextcloud Tables app (versions 0.9.0-0.9.6 and 1.0.0-1.0.1) due to improper neutralization of special elements in the ORDER BY statement of a database query. An attacker with access to the Tables app can provide a malicious sort order argument to perform a blind SQL injection. This specific injection is limited to extracting a single bit of information per request or executing time-based attacks (making the database wait). The vulnerability is tracked as CWE-89 and has been patched in versions 0.9.7 and 1.0.2.
Affected products
- Nextcloud Tables 0.9.0 to 0.9.6, 1.0.0 to 1.0.1
Timeline
- 2025-12-05: other: Initial code refactor and cleanup pull request submitted
- 2026-05-13: advisory: Nextcloud security advisory published
- 2026-06-01: disclosed: CVE-2026-45722 published to NVD