Description
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.
Affected products
nextcloud: nextcloud server
References4
- github.com/nextcloud/security-advisories/security/advisories/GH… PatchVendor Advisory
- hackerone.com/reports/2890071 Issue TrackingVendor Advisory
- github.com/nextcloud/server/commit/7cc005c43c72bc384848cf8cb851… Patch
- github.com/nextcloud/server/pull/50992 Issue Tracking
Metrics
- CVSS 3.1
-
4.3
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - EPSS — exploit probability
- 0% percentile: 27 · as of 11 November 2026
- CWE
- CWE-778
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.