CVE-2026-45157: Nextcloud: Valid share tokens allow to access tempory upload files of share owner
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a malicious user has access to a file share of a user, they could use this share token to also access the chunking upload directly and see temporary part files during on going uploads. It is recommended that the Nextcloud Server is upgraded to 32.0.9 or 33.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9 or 33.0.3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nextcloud Serverto a version that resolves this vulnerability.Fixed in 32.0.9 - Upgrade
Upgrade
Nextcloud Serverto a version that resolves this vulnerability.Fixed in 33.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45157?
CVE-2026-45157 has a medium severity score of 6.3.
How do I fix CVE-2026-45157?
To fix CVE-2026-45157, upgrade Nextcloud to version 32.0.9 or 33.0.3 and later.
What type of access does CVE-2026-45157 allow?
CVE-2026-45157 allows a malicious user to access temporary upload files of the share owner.
Which versions of Nextcloud are affected by CVE-2026-45157?
CVE-2026-45157 affects Nextcloud Server versions 32.0.0 to before 32.0.9 and 33.0.0 to before 33.0.3.
What could happen if CVE-2026-45157 is exploited?
Exploiting CVE-2026-45157 could lead to unauthorized access to sensitive temporary files of users.