Riskcovery

CVE-2022-39210

Access to internal files of the Nextcloud Android app

State
Published
Severity
3.2 Low
Published
Sep 16, 2022
Updated
Apr 23, 2025
Reserved
Sep 2, 2022

Read the record on cve.org

Description

Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possible. This may lead to a leak of sensitive information in some cases. It is recommended that the Nextcloud Android app is upgraded to 3.21.0. There are no known workarounds for this issue.

Scores

CVSSScoreVectorSource
3.13.2 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:NGitHub_M

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
security-advisoriesnextcloud
  • < 3.21.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.