Combination of content provider allows private data disclosure #534541 Valid Access Control Low 2019-07-26 $100 14 Linux client is vulnerable to directory traversal when downloading files #590319 Valid File and Path Handling Medium 2020-08-17 $250 14 Delete permission can be added on reshare #633245 Valid Access Control Low 2019-09-03 – 14 Content Spoofing /Text Injection in https://docs.nextcloud.com #666557 Valid Misconfiguration and Insecure Design Low 2019-09-05 – 14 Android app does not clear end to end encryption keys #1189168 Valid No weakness recorded Low 2021-06-16 $100 14 Virtual Data Room / Hide download on collabora is easy to bypass #1194606 Valid Access Control High 2021-08-07 $150 14 bypass forced password protection via circles app #1406926 Valid Input Validation and Logic Low 2022-06-19 $100 14 Reference caching can leak data to unauthorized users #1767503 Valid Information Disclosure Medium 2023-01-13 – 14 Blind SSRF as normal user from mailapp #1913095 Valid Server-Side Request Forgery Low 2023-05-30 – 14 Email Spoofing Vulnerability from nextcloud. #229599 Spam No weakness recorded High 2017-05-18 – 15 Non-admin users can trigger writes to memcached by entering a malicious server as a share URL #592864 Valid Injection and Smuggling Medium 2020-07-09 $100 15 Exposing debug.log file leads to server full path disclosure #696360 Valid Information Disclosure Low 2019-10-17 – 15 Access Control: Inject tasks into other users decks #867052 Valid Access Control Medium 2021-02-02 – 15 Take over a mail account due missing validation of account id #1094063 Valid Access Control Medium 2021-06-01 – 15 File drop public link can also be converted to federated share #1167929 Valid Access Control Low 2021-06-10 $500 15 Guests can continue to receive video streams from call after being removed from a conversation #1706248 Valid Information Disclosure Medium 2022-12-31 – 15 Messages can still be seen on conversation after expiring when cron is misconfigured #1784310 Valid Information Disclosure Low 2023-02-27 – 15 Responsive Server-side Request Forgery (SSRF) #1895874 Valid Server-Side Request Forgery Medium 2023-10-19 – 15 Twitter Account hijack @nextcloudfrance #1916565 Valid No weakness recorded Medium 2023-03-30 – 15 Stored XSS in contacts app via organisation and title field #3293290 Valid Cross-site Scripting Low 2026-01-04 $100 15 Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections #3303283 Valid Server-Side Request Forgery Medium 2026-09-17 – 15 Android - Possible to intercept broadcasts about uploaded files #167481 Valid Information Disclosure – 2017-03-23 – 16 DOM XSS vulnerability in search dialogue (NC-SA-2017-007) #213227 Valid Cross-site Scripting Low 2017-06-07 $250 16 Docker image with FPM is vulnerable to CVE-2019-11043 #720306 Valid Command and Code Injection Critical 2020-03-14 $100 16 Missing server side controls when editing the board’s sharing permissions per user #827816 Valid Access Control High 2020-09-28 – 16 No rate limiting on sinup page #922470 Valid Input Validation and Logic Low 2020-09-28 – 16 Possible denial of service when entering a loooong password #952349 Valid Authentication Medium 2020-09-16 – 16 HEIC image preview can be used to invoke Imagick #1261413 Valid Information Disclosure Critical 2023-01-07 – 16 Exposed Log File Lead to Full Internal path disclosure at [https://nextcloud.com/wp-content/debug.log] #1767439 Valid Information Disclosure Low 2022-12-15 – 16 Error when editing a calendar appointment returns stacktrace and query #2108342 Valid Information Disclosure Medium 2024-01-17 – 16 Shared smart albums in the Photos app can expose files outside the album owner's configured source folders #3506873 Valid Access Control Medium 2026-09-17 – 16 Activity app does not verify federated file activity received from remote servers #3534050 Valid Authentication Low 2026-09-05 $150 16 Access control issue -- [Allow file system access not validated when using session auth] #388515 Valid Access Control Medium 2018-09-25 $100 17 xmlrpc.php is enabled - Nextcloud #458696 Valid Access Control Medium 2020-03-01 – 17 Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color` #605915 Valid Cross-site Scripting Medium 2019-08-29 – 17 User with read-only access to a share can gain write access to sub-folders in the share #619484 Valid Access Control Medium 2020-03-01 – 17 XSS in desktop client via invalid server address on login form #685552 Valid Cross-site Scripting Medium 2020-08-17 – 17 Reflected XSS when renaming a file with a vulnerable name which results in an error #896522 Valid Cross-site Scripting Medium 2021-03-01 $100 17 public webdav endpoint not bruteforce protected #1192159 Valid No weakness recorded Low 2021-08-11 $100 17 Ransomware protection is missing extentions take 2 #1200785 Valid No weakness recorded Low 2021-07-16 $100 17 Password disclosure in initial setup of Mail App #1561471 Valid Cryptography Low 2022-09-03 – 17 Unauthenticated SSRF in 3rd party module "cerdic/csstidy" #1595006 Valid Server-Side Request Forgery Medium 2022-09-03 $250 17 Missing rate limiting on password reset functionality allows to send lot of emails #1691195 Valid Access Control Low 2023-03-05 $100 17 Suspicious login app ships old league/flysystem version #1720822 Valid Misconfiguration and Insecure Design – 2023-02-08 – 17 Chat room member disclosure via autocomplete API #1850407 Valid Access Control Medium 2023-03-25 – 17 Missing brute force protection for passwords of password protected share links #1894653 Valid Authentication Low 2023-04-25 – 17 Users can set up workflows using restricted and invisible system tags #1895976 Valid Access Control Medium 2023-05-17 – 17 FederationController::remoteWopiToken() returns full Wopi entity without token type validation #3568116 Valid Access Control Low 2026-10-27 – 17 SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards #3576823 Valid Server-Side Request Forgery Medium 2026-10-27 $250 17 Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11 #145392 Valid Misconfiguration and Insecure Design – 2016-08-17 – 18