Nextcloud Server vulnerabilities
6 CVEs affecting Nextcloud Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77165, published 2026-09-21.
More from Nextcloud.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2021-41178, published 2021-10-25. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images…
- CVE-2021-41179, published 2021-10-25. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as…
- CVE-2026-77165, published 2026-09-21. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.
- CVE-2026-82985, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration.…
- CVE-2026-68493, published 2026-09-18. Low severity, CVSS 3.1. EPSS: 0.2% chance of exploitation in the next 30 days. After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.
- CVE-2026-77164, published 2026-09-18. Medium severity, CVSS 6.2. EPSS: 0.2% chance of exploitation in the next 30 days. Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this…