SQL Injection Vulnerability in Nextcloud Tables App
CVE-2026-45722
7.1HIGH
What is CVE-2026-45722?
The Nextcloud Tables app, part of the open-source content collaboration platform, contains a vulnerability due to missing sanitization processes. This flaw allows users with access to the tables feature to execute a limited SQL injection on the ORDER BY statement of a query. Although the SQL injection is constrained, it enables the extraction of a single data element per request or can be exploited to induce delays in database response times. Users are advised to upgrade to versions 0.9.7 and 1.0.2, where the issue has been effectively addressed.
Affected Version(s)
security-advisories >= 0.9.0, < 0.9.7 < 0.9.0, 0.9.7
security-advisories >= 1.0.0, < 1.0.2 < 1.0.0, 1.0.2