CVE-2021-32734
File path disclosure of shared files in Nextcloud Text application
Reported by github_m · Published July 12, 2021
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud Text application in Nextcloud Server app settings.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| nextcloud | Arch Linux | 21.0.3-1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | < 19.0.13, >= 20.0.0, < 20.0.11, >= 21.0.0, < 21.0.3 |
| arch | nextcloud | 0 |
| nextcloud | security-advisories | 0, 20.0.0, 21.0.0 |
Timeline
- Jul 12, 2021 CVE Published
- Jul 13, 2021 EPSS Score (30 in total, the first dated here)
- Aug 11, 2021 PoC Published
- Mar 10, 2026 Security Advisory (2 in total, the first dated here)
- Aug 1, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-32734
vulnetix vdb fixes CVE-2021-32734Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-32734/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_CONFIRM
- x_refsource_MISC
- x_refsource_MISC
- GLSA-202208-17 vendor-advisoryx_refsource_GENTOO