CVE-2021-41178

Katalog CVE

CVSS 6.5 · Medium EPSS 1,8%

Kerentanan Relative Path Traversal pada nextcloud server. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishing attack, an attacker could upload a malicious SVG file that mimics the Nextcloud login form and send a specially crafted link to victims. The XSS risk here is mitigated due to the fact that Nextcloud employs a strict Content-Security-Policy disallowing execution of arbitrary JavaScript. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.

Rincian

Terbit di NVD

25 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal
CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/server/pull/28726 patch · advisory pihak ketiga
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jp9c-vpr3-m5rf advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-17 advisory pihak ketiga
• https://hackerone.com/reports/1302155 permissions required