Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or to make the database wait for a given time. This issue has been patched in versions 0.9.7 and 1.0.2.
References
| Link | Resource |
|---|---|
| https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5h2w-c7px-hp4j | Mitigation Vendor Advisory |
| https://github.com/nextcloud/tables/pull/2186 | Issue Tracking Patch |
| https://hackerone.com/reports/3446689 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
04 Jun 2026, 16:50
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Nextcloud
Nextcloud tables |
|
| CPE | cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:* | |
| References | () https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5h2w-c7px-hp4j - Mitigation, Vendor Advisory | |
| References | () https://github.com/nextcloud/tables/pull/2186 - Issue Tracking, Patch | |
| References | () https://hackerone.com/reports/3446689 - Permissions Required |
01 Jun 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-01 19:16
Updated : 2026-06-04 16:50
NVD link : CVE-2026-45722
Mitre link : CVE-2026-45722
CVE.ORG link : CVE-2026-45722
JSON object : View
Products Affected
nextcloud
- tables
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')