Nextcloud vulnerabilities
We track 49 vulnerabilities in Nextcloud products across 16 products. 49 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Nextcloud vulnerabilities
- 7.1 High severity
security-advisories: Improper Restriction of Excessive Authentication Attempts
Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations for the password reset token. As of commit `704eb3aa` password
- 7.8 High severity
security-advisories: Improper Restriction of Excessive Authentication Attempts
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prio
- 7.5 High severity
security-advisories: Improper Access Control
Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shares can be circumvented if reshare permissions are also given. T
- 7.5 High severity
security-advisories: Improper Limitation of a Pathname to a Restricted Directory
Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The function is used in the `newFile()` and `newFolder()` items, which m
- 8.8 High severity
security-advisories: Cross-Site Request Forgery
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows
- 7.8 High severity
security-advisories: Improper Control of Generation of Code
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In version 3.6.0, if a user received a malicious file share and has it synced locally or the virtual filesystem enabled and clicked a nc://open/ link it will
- 7.5 High severity
security-advisories: Incorrect Authorization
Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is
- 9.8 Critical severity
security-advisories: Server-Side Request Forgery
Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css-tidy/css_optimiser.php`. Access to the minifier is unrestricted and access may lead to Server-Side R
- 9.8 Critical severity
security-advisories: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject ne