CVE-2026-45722CWE-89

Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views

High · published June 1, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or to make the database wait for a given time. This issue has been patched in versions 0.9.7 and 1.0.2.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00489 · 41.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-06-01T17:11Z
EPSS history
Timeline
  • 01 JUN 17:11Z
    Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
    cvelistv5