Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is upgraded to 32.0.4, 31.0.14. It is recommended that the Nextcloud Enterprise Server is upgraded to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15
References
| Link | Resource |
|---|---|
| https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j33j-qph5-4wch | Mitigation Vendor Advisory |
| https://github.com/nextcloud/server/pull/57414/files | Issue Tracking Patch |
| https://hackerone.com/reports/3468140 | Permissions Required |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
03 Jun 2026, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:* |
|
| References | () https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j33j-qph5-4wch - Mitigation, Vendor Advisory | |
| References | () https://github.com/nextcloud/server/pull/57414/files - Issue Tracking, Patch | |
| References | () https://hackerone.com/reports/3468140 - Permissions Required | |
| First Time |
Nextcloud
Nextcloud nextcloud Server |
01 Jun 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-01 19:16
Updated : 2026-06-03 17:15
NVD link : CVE-2026-45279
Mitre link : CVE-2026-45279
CVE.ORG link : CVE-2026-45279
JSON object : View
Products Affected
nextcloud
- nextcloud_server
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')