CVE-2026-45279: Nextcloud Server Path Traversal Allows Unauthorized File Copy

Technical summary

A path traversal vulnerability (CWE-22) has been identified in Nextcloud Server affecting versions 31.0.0 through 31.0.13 and 32.0.0 through 32.0.3. The vulnerability stems from improper handling of the {lang} placeholder in template directory configuration values. When this placeholder is used, the application fails to adequately sanitize user-supplied path inputs, permitting authenticated users to traverse directory structures and copy arbitrary files into their own user-controlled directories. Exploitation success depends on the underlying Unix file system permissions governing the source files and destination locations.

Business impact

This vulnerability could lead to unauthorized file disclosure or file placement within user directories, potentially exposing sensitive configuration files, shared content, or other data stored on the Nextcloud instance. The impact is confined to file operations within the scope of Unix permissions, so the blast radius depends heavily on file ownership and access controls. For organizations running affected Nextcloud versions, this represents a medium-severity insider risk requiring prompt attention.

Affected systems

Nextcloud Server open-source installations versions 31.0.0 through 31.0.13 and 32.0.0 through 32.0.3 are vulnerable. Nextcloud Enterprise Server users should verify their version against the following patch guidance. Organizations using maintained branches (e.g., version 30, 29, 28) should also monitor for recommended updates.

Exploitability

Exploitation requires an authenticated Nextcloud user account—non-admin users can trigger this issue in certain configurations. The CVSS score of 4.4 (Medium) reflects the high access privileges required (PR:H), complex attack conditions (AC:H), and limited confidentiality impact (C:H). This is not a remote unauthenticated vulnerability and is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no active public exploitation has been confirmed.

Remediation

Nextcloud Server users must upgrade to version 31.0.14 or later, or 32.0.4 or later, depending on their current branch. Nextcloud Enterprise Server users should upgrade to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, or 28.0.14.15 as applicable. Verify your current version in the Nextcloud administration panel and cross-reference against the vendor advisory before patching.

Patch guidance

Open-source Nextcloud Server: Upgrade to 31.0.14 or 32.0.4 or later. Nextcloud Enterprise Server: Upgrade to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, or 28.0.14.15 depending on your currently supported branch. Test patches in a staging environment first, especially if you have custom template configurations using the {lang} placeholder. Review your template directory configuration after patching to ensure the vulnerability vector has been removed.

Detection guidance

Monitor Nextcloud logs for unusual file copy or file write operations originating from non-admin users, particularly targeting directories outside their user-home scope. Look for path traversal patterns (../, ..\) in Nextcloud API logs or audit trails. If template directory configuration contains {lang}, prioritize your upgrade timeline. Consider implementing file integrity monitoring (FIM) on critical Nextcloud data directories to detect unauthorized file modifications or copies.

Why prioritize this

While this is a medium-severity issue requiring elevated user access, the potential for unauthorized file disclosure and the scope of affected versions (multiple supported branches) warrant timely remediation. Organizations with permissive Unix file permissions or multi-tenant Nextcloud instances should prioritize patching to limit insider-threat risks. The absence of KEV status and public exploits suggests this is not an immediate emergency, but should be included in the current patch cycle.

Risk score, explained

CVSS 4.4 (Medium) reflects a vulnerability requiring authentication (PR:H), high attack complexity due to Unix permission dependencies (AC:H), with confidentiality impact (C:H) but no integrity or availability impact under the standard attack scenario. The score appropriately weights this as a medium-priority issue requiring action but not emergency response.

Frequently asked questions