Cross-Site Vulnerability in Nextcloud's End-to-End Encryption Features
CVE-2026-45159
What is CVE-2026-45159?
Nextcloud, the popular open-source content collaboration platform, has disclosed a vulnerability that permits a malicious user with access to an end-to-end encrypted files drop link to drop files into other encrypted folders belonging to the share owner. Importantly, while this vulnerability enables file dropping, it does not allow for reading or modifying existing files within those folders. Users are strongly urged to update their Nextcloud installations to the patched versions 1.15.4, 1.16.3, 1.17.1, 1.18.1, or 2.0.0-rc.7 to mitigate this issue and enhance their data security.
Affected Version(s)
security-advisories >= 1.15.0, < 1.15.4 < 1.15.0, 1.15.4
security-advisories >= 1.16.0, < 1.16.3 < 1.16.0, 1.16.3
security-advisories >= 1.17.0, < 1.17.1 < 1.17.0, 1.17.1