CVE-2022-39334: Nextcloud Desktop

Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days.

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server.

Affected products

• Nextcloud Desktop: before 3.6.1 (fixed in 3.6.1)

Published 2022-11-25. Last modified 2026-06-17.