A Closer Look at the Nextcloud File Tagging Issue
Nextcloud Server, a popular self-hosted cloud solution, has a vulnerability that could let regular users access or change file tags they shouldn’t be able to. Imagine someone adding a “confidential” tag to a file they don’t have permission to see – that’s the kind of thing this flaw could enable.
This issue affects how users manage tags on files. Even without special privileges, a user could potentially alter tags on files that are outside their authorized access. While it doesn’t allow full access to the file content, it could expose sensitive information through improper tagging or aid in further attacks.
## CVE Details
* **Product:** Nextcloud Server & Nextcloud Enterprise Server
* **Published:** December 05, 2025
* **Severity:** Medium
* **Status:** Analyzed
## Affected Products
This vulnerability specifically impacts Nextcloud Server and Nextcloud Enterprise Server versions prior to 31.0.1.
## Current Status
This vulnerability has been analyzed and addressed by the Nextcloud team.
## Severity Level
The vulnerability is rated as Medium, with a CVSS score of 4.3. This indicates a moderate level of risk, suggesting that while not critically severe, it warrants attention and timely patching.
## Possible Solutions
The Nextcloud team has released a fix for this vulnerability. Users are strongly advised to update their Nextcloud Server or Nextcloud Enterprise Server instances to version 31.0.1 or later. This update addresses the flaw in the file tagging mechanism, preventing unauthorized modifications.
Applying security updates promptly is crucial for maintaining the integrity and security of your self-hosted cloud environment. Regularly checking for and applying patches from software vendors is a fundamental practice in cybersecurity.
## References
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hq6c-r898-fgf2
https://github.com/nextcloud/server/commit/b44f1568f2dc97c746281d99e2342ad679e3d8a9
https://github.com/nextcloud/server/issues/51247
https://github.com/nextcloud/server/pull/51288
https://hackerone.com/reports/3040887
