CVE-2026-45279: Nextcloud: Limited path traversal via template API if using `{lang}` in config
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is upgraded to 32.0.4, 31.0.14. It is recommended that the Nextcloud Enterprise Server is upgraded to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nextcloud Serverto a version that resolves this vulnerability.Fixed in 32.0.4 - Upgrade
Upgrade
Nextcloud Serverto a version that resolves this vulnerability.Fixed in 31.0.14 - Upgrade
Upgrade
Nextcloud Serverto a version that resolves this vulnerability.Fixed in 30.0.17.7 - Upgrade
Upgrade
Nextcloud Serverto a version that resolves this vulnerability.Fixed in 29.0.17.12 - Upgrade
Upgrade
Nextcloud Serverto a version that resolves this vulnerability.Fixed in 28.0.14.15
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45279?
The severity of CVE-2026-45279 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-45279?
To fix CVE-2026-45279, upgrade to Nextcloud Server version 31.0.14 or 32.0.4 or later.
What versions of Nextcloud are affected by CVE-2026-45279?
CVE-2026-45279 affects Nextcloud Server versions from 31.0.0 to before 31.0.14 and 32.0.0 to before 32.0.4.
What kind of vulnerability is CVE-2026-45279?
CVE-2026-45279 is a path traversal vulnerability that allows limited file access to non-admin users.
Can non-admin users exploit CVE-2026-45279?
Yes, non-admin users can exploit CVE-2026-45279 under certain conditions to copy arbitrary files.