Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Content spoofing on https://surveyserver.nextcloud.com#473144	Valid	Injection and Smuggling	Low	2021-02-14	–	2
XSS in Desktop Client via user status and information#1707977	Valid	Injection and Smuggling	Low	2022-11-25	–	5
XSS in Desktop Client in call notification popup#1711847	Valid	Injection and Smuggling	Low	2022-11-25	–	5
Control character filtering misses leading and trailing whitespace in file and folder names#1402249	Valid	Injection and Smuggling	Medium	2022-05-27	–	8
Non-admin users can trigger writes to memcached by entering a malicious server as a share URL#592864	Valid	Injection and Smuggling	Medium	2020-07-09	$100	15
SMTP Command Injection in iCalendar Attachments to Emails via Newlines#1516377	Valid	Injection and Smuggling	Medium	2022-07-04	–	22
Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist#2251074	Valid	Injection and Smuggling	Medium	2024-01-18	–	22
SMTP Command Injection in Appointment Emails via NewlinesAnalysed#1509216	Valid	Injection and Smuggling	Medium	2022-12-27	–	27
Unquoted body background attribute enables CSS injection that bypasses remote image blockingAnalysed#3590583	Valid	Injection and Smuggling	Medium	2026-04-20	–	35
xmlrpc.php &wp-cron.php files are enabled, and will used for (DDOS),(DOS) and broutforce users attack.Analysed#2299069	Valid	Injection and Smuggling	–	2024-02-08	–	41
position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.Analysed#3590586	Valid	Injection and Smuggling	Medium	2026-04-20	–	44
Nextcloud Desktop Client RCE via malicious URI schemesAnalysed#1078002	Valid	Injection and Smuggling	Medium	2021-04-15	$1,000	73

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.