CVE-2026-45154
Nextcloud Collective Pages Path Traversal via Trashbin Access
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nextcloud | collectives | From 2.6.0 (inc) to 4.3.0 (exc) |
| nextcloud | collectives | From 3.5.0 (inc) to 4.3.0 (inc) |
| nextcloud | collectives | 4.3.0 |
| nextcloud | nextcloud | From 2.6.0 (inc) to 4.3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Nextcloud Collectives app versions from 2.6.0 up to but not including 4.3.0. When a collective page was deleted and the collective was shared with view-only permissions, guests who had access to the collective could still access the deleted pages directly from the trashbin. This is due to improper access control, allowing unauthorized viewing of deleted content.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability can be mitigated by upgrading the Nextcloud Collectives app to version 4.3.0 or later, where the issue has been patched.
No workaround is available, so applying the update is the recommended immediate step.
How can this vulnerability impact me? :
The impact of this vulnerability is limited to unauthorized access to deleted collective pages by guests with view-only access. It does not affect data integrity or availability. The severity is rated as low with a CVSS score of 2.6. An attacker would require low privileges and some user interaction to exploit this issue.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows view-only guests to access deleted pages directly from the trashbin, which indicates improper access control.
This improper access control could potentially lead to unauthorized access to sensitive or personal data, which may impact compliance with data protection regulations such as GDPR or HIPAA.
However, the provided information does not explicitly state the direct impact on compliance with these standards or regulations.