CVE-2022-24888

MEDIUM

Nextcloud Server < 20.0.14.4 - File and Folder Name Injection via Leading/Trailing Whitespace Characters

Title source: llm
STIX 2.1

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. This issue is fixed in versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1. There are currently no known workarounds.

References (4)

Core 4
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/nextcloud/server/pull/29895
Permissions Required, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1402249
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202208-17

Scores

CVSS v3 4.3
EPSS 0.0038
EPSS Percentile 59.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-74
Status published
Products (1)
nextcloud/nextcloud_server < 20.0.14.4
Published Apr 27, 2022
Tracked Since Feb 18, 2026