Nextcloud · disclosed reports
Command and Code Injection
18 disclosed reports · $675 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Nextcloud on HackerOne- reports
- 18
- paid a bounty
- 5
Every one of the 18 is a mark on the map. Named now: 1 to 18, most upvoted first.
- Code injection possible with malformed Nextcloud Talk chat commands
- Remote Code Execution via Extract App Plugin
- Arbitrary code execution in desktop client via OpenSSL config
- Code injection in Nextcloud Desktop Client for macOS
- Code injection in macOS Desktop Client
- Docker image with FPM is vulnerable to CVE-2019-11043
- Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link
- Code injection allows unprivileged local attacker to execute arbitrary code in Nextcloud's OAuth/web renderer process
- RCE on 17 different Docker containers on your network
- Download of file with arbitrary extension via injection into attachment header
- [FG-VD-17-063] NextCloud Insufficient Attack Protection Vulnerability Notification
- Some HTML Tags are Getting Executed in com.nextcloud.client
- (Authenticated) RCE by bypassing of the .htaccess blacklist
- Formula Injection vulnerability in CSV export feature
- potential RCE and XSS via file upload requiring user account and default settings
- Possible RCE
- Review remote code execution in SwiftMailer
- REG: Content provider information leakage
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.