Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Code injection possible with malformed Nextcloud Talk chat commandsAnalysed#851807 | Valid | Command and Code Injection | High | 2020-06-02 | – | 317 |
| Remote Code Execution via Extract App PluginAnalysed#546753 | Valid | Command and Code Injection | High | 2019-05-30 | – | 124 |
| Arbitrary code execution in desktop client via OpenSSL configAnalysed#622170 | Valid | Command and Code Injection | Medium | 2020-08-05 | $100 | 59 |
| Code injection in Nextcloud Desktop Client for macOSAnalysed#2307625 | Valid | Command and Code Injection | – | 2024-06-14 | $250 | 37 |
| Code injection in macOS Desktop ClientAnalysed#633266 | Valid | Command and Code Injection | Low | 2020-04-10 | – | 29 |
| Docker image with FPM is vulnerable to CVE-2019-11043#720306 | Valid | Command and Code Injection | Critical | 2020-03-14 | $100 | 16 |
| Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link#1720043 | Valid | Command and Code Injection | Medium | 2023-02-10 | – | 13 |
| Code injection allows unprivileged local attacker to execute arbitrary code in Nextcloud's OAuth/web renderer process#3772818 | Valid | Command and Code Injection | Low | 2026-10-24 | – | 11 |
| RCE on 17 different Docker containers on your network#1332433 | Valid | Command and Code Injection | Critical | 2021-10-20 | – | 10 |
| Download of file with arbitrary extension via injection into attachment header#1215263 | Valid | Command and Code Injection | Medium | 2021-08-11 | $125 | 10 |
| [FG-VD-17-063] NextCloud Insufficient Attack Protection Vulnerability Notification#232347 | Valid | Command and Code Injection | Low | 2018-07-29 | $100 | 10 |
| Some HTML Tags are Getting Executed in com.nextcloud.client#631227 | Valid | Command and Code Injection | None | 2019-07-26 | – | 9 |
| (Authenticated) RCE by bypassing of the .htaccess blacklist#228825 | Valid | Command and Code Injection | Critical | 2020-03-01 | – | 7 |
| Formula Injection vulnerability in CSV export feature#928280 | Valid | Command and Code Injection | Medium | 2021-03-04 | – | 6 |
| potential RCE and XSS via file upload requiring user account and default settings#678727 | Valid | Command and Code Injection | High | 2020-04-01 | – | 5 |
| Possible RCE#145343 | Informative | Command and Code Injection | – | 2018-03-08 | – | 5 |
| Review remote code execution in SwiftMailer#194564 | Valid | Command and Code Injection | None | 2017-02-18 | – | 4 |
| REG: Content provider information leakage#146179 | Informative | Command and Code Injection | – | 2016-06-24 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.