CVE-2026-45279

MEDIUM

Nextcloud Server 31.0.0-31.0.13 and 32.0.0-32.0.3 - Path Traversal via Template Directory Config

Title source: llm
STIX 2.1

Description

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is upgraded to 32.0.4, 31.0.14. It is recommended that the Nextcloud Enterprise Server is upgraded to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://hackerone.com/reports/3468140

Scores

CVSS v3 4.4
EPSS 0.0039
EPSS Percentile 30.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (4)
nextcloud/nextcloud_server 28.0.0 - 28.0.14.15
nextcloud/nextcloud_server 31.0.0 - 31.0.14
nextcloud/security-advisories >= 31.0.0, < 31.0.14
nextcloud/security-advisories >= 32.0.0, < 32.0.4
Published Jun 01, 2026
Tracked Since Jun 02, 2026