Nextcloud · disclosed reports
File and Path Handling
9 disclosed reports · $1,750 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Nextcloud on HackerOne- reports
- 9
- paid a bounty
- 3
Every one of the 9 is a mark on the map. Named now: 1 to 9, most upvoted first.
- Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet Library
- Path traversal allows tricking the Talk Android app into writing files into it's root directory
- Remote code execution via path traversal in Zip extraction in the Extract app
- Arbitrary read of all SVG files on a Nextcloud server
- SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent
- Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider
- Linux client is vulnerable to directory traversal when downloading files
- Access to arbitrary file of the Nextcloud Android app from within the Nextcloud Android app
- Potential directory traversal in OC\Files\Node\Folder::getFullPath
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.