CVE-2026-45159

תיאור (מקור, אנגלית)

Nextcloud is an open source content collaboration platform. From versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1, and 1.18.0 to before 1.18.1, a malicious user with access to an end-to-end encrypted files drop link was able to also drop files into other end-to-end encrypted folders of the share owner. Reading and modifying of other files was not possible. This issue has been patched in versions 1.15.4, 1.16.3, 1.17.1, 1.18.1, and 2.0.0-rc.7.

מדדים

CVSS 3.1

3.5 (LOW) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-7/8/2026

CWE

CWE-639

קישורים

• https://github.com/nextcloud/end_to_end_encryption/pull/1395
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p3qw‮…
• https://hackerone.com/reports/3304830