Nextcloud, a popular open-source platform for content collaboration, has identified a security flaw in its server software. This vulnerability, tracked as CVE-2026-45279, could allow unauthorized users to potentially access or copy files they shouldn’t be able to.
When a specific configuration setting, templatedirectory, uses the {lang} variable, non-administrator users might exploit this to trick the system. They could craft special requests that allow them to copy files from restricted parts of the server into their own Nextcloud directories. The success of such an attack depends on the existing file permissions on the Unix-based system where Nextcloud is hosted. This type of attack is known as a path traversal vulnerability.
The good news is that Nextcloud has already released updates to address this issue.
CVE Details
- Product Name: Nextcloud Server, Nextcloud Enterprise Server
- Published: June 1, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
This vulnerability impacts specific versions of both Nextcloud Server and Nextcloud Enterprise Server.
For Nextcloud Server:
- Versions from 31.0.0 up to, but not including, 31.0.14 are affected.
- Versions from 32.0.0 up to, but not including, 32.0.4 are affected.
For Nextcloud Enterprise Server:
- Versions from 28.0.0 up to, but not including, 28.0.14.15 are affected.
- Versions from 29.0.0 up to, but not including, 29.0.17.12 are affected.
- Versions from 30.0.0 up to, but not including, 30.0.17.7 are affected.
- Versions from 31.0.0 up to, but not including, 31.0.14 are affected.
- Versions from 32.0.0 up to, but not including, 32.0.4 are affected.
Current Status
The vulnerability CVE-2026-45279 is currently listed as “Analyzed,” meaning it has been thoroughly investigated and understood. Patches have been released by Nextcloud to address the flaw.
Severity Level
The vulnerability has been assigned a Medium severity rating with a CVSS score of 4.4 out of 10. This indicates that while the vulnerability is not critical, it still poses a notable risk due to the potential for unauthorized file copying. Exploiting this flaw requires high privileges and high attack complexity, but successful exploitation could lead to high confidentiality impact, allowing attackers to access sensitive information.
Possible Solutions
Nextcloud strongly recommends that all users upgrade their server installations to the patched versions as soon as possible.
For Nextcloud Server users, please upgrade to:
- Version 32.0.4
- Version 31.0.14
For Nextcloud Enterprise Server users, please upgrade to:
- Version 32.0.4
- Version 31.0.14
- Version 30.0.17.7
- Version 29.0.17.12
- Version 28.0.14.15
Workaround:
If immediate upgrades are not feasible, a temporary workaround is to remove {lang} from the templatedirectory configuration value. However, upgrading to the patched versions remains the most effective and recommended solution.
References
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j33j-qph5-4wch
https://github.com/nextcloud/server/pull/57414/files
https://hackerone.com/reports/3468140
