Path Traversal in Nextcloud Server

Executive Summary

CVE-2026-45279 is a path traversal vulnerability in Nextcloud Server and Enterprise Server that occurs when the {lang} placeholder is used in the template directory configuration. This flaw allows non-admin users, under certain conditions and depending on Unix permissions, to copy arbitrary files into their own Nextcloud directory. The vulnerability arises from insufficient input sanitization of language strings, which can be exploited to manipulate file paths.

The issue was fixed by improving input sanitization in the cleanLanguage method, ensuring invalid characters are removed from language strings before processing, thus preventing path traversal or injection attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows non-admin users to copy arbitrary files into their own Nextcloud directory via a path traversal attack, potentially exposing sensitive data depending on Unix permissions.

Such unauthorized access to files could lead to confidentiality breaches, which may impact compliance with data protection regulations like GDPR and HIPAA that require strict controls on access to personal and sensitive information.

Therefore, if exploited, this vulnerability could undermine compliance efforts by enabling unauthorized data access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing non-admin users to copy arbitrary files into their own Nextcloud directory if they can exploit the path traversal flaw. This could lead to unauthorized access to sensitive files, potentially exposing confidential information depending on the Unix file permissions.

The CVSS score of 4.4 indicates a moderate risk, with a high impact on confidentiality but requiring high privileges and complex attack conditions to exploit.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the use of the {lang} placeholder in the template directory configuration of Nextcloud Server or Enterprise Server, which can lead to path traversal attacks by non-admin users.

To detect if your system is vulnerable, check the Nextcloud configuration files for the presence of the {lang} placeholder in the template directory setting.

You can use commands to search for this placeholder in your Nextcloud configuration directory. For example:

• grep -r '\{lang\}' /path/to/nextcloud/config/
• grep -r 'template_directory' /path/to/nextcloud/config/ | grep '\{lang\}'

Additionally, review user activity logs for suspicious file copy operations or unexpected file creations in user directories, which might indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade your Nextcloud Server or Enterprise Server to the patched versions where this vulnerability is fixed.

• Upgrade Nextcloud Server to version 31.0.14 or 32.0.4 (or later).
• Upgrade Nextcloud Enterprise Server to version 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, or 28.0.14.15 (or later).

If immediate upgrade is not possible, remove the {lang} placeholder from the template directory configuration to prevent exploitation.

Ensure that Unix file permissions are properly set to restrict unauthorized file copying.

Useful 0 Not Useful 0