Nextcloud Server and Enterprise Temporary File Exposure Vulnerability

A vulnerability exists in Nextcloud Server versions 32.0.0 prior to 32.0.9 and 33.0.0 prior to 33.0.3, as well as in Nextcloud Enterprise Server versions 26.0.0, 27.0.0, 28.0.0, 29.0.0, 30.0.0, 31.0.0, 32.0.0, and 33.0.0. When a malicious user has access to a file share, they can use the share token to access chunked uploads directly, revealing temporary part files of ongoing uploads.

Impact

Exploitation allows access to intermediate upload files of the share owner, potentially leading to unauthorized data exposure.

Remediation

Users are advised to upgrade Nextcloud Server to version 32.0.9 or 33.0.3. Nextcloud Enterprise Server users should upgrade to versions 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9 or 33.0.3.