CVE-2026-45279CWE-22

Nextcloud: Limited path traversal via template API if using `{lang}` in config

Medium · published June 1, 2026

CVSS v3.1
4.4
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is upgraded to 32.0.4, 31.0.14. It is recommended that the Nextcloud Enterprise Server is upgraded to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00575 · 46.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-01T16:52Z
EPSS history
Timeline
  • 01 JUN 16:52Z
    Nextcloud: Limited path traversal via template API if using `{lang}` in config
    cvelistv5