CVE-2021-32766

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link share has been created with "Upload Only" privileges. (aka "File Drop"). A link share recipient is not expected to see which folders or files exist in a "File Drop" share. Using this vulnerability an attacker is able to enumerate folders in such a share. Exploitation requires that the attacker has access to a valid affected "File Drop" link share. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.0.1. Users who are unable to upgrade are advised to disable the Nextcloud Text application in the app settings.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published
Sep 7, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-327676.5TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 througCVE-2021-327686.1TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, CVE-2021-327697.5Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versionCVE-2021-32777.2Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in CVE-2021-327707.5Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP BasicCVE-2021-327718.1Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overfloCVE-2021-327728.8Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious charactersCVE-2021-327737.5Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluateCVE-2021-327745.4DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no prCVE-2021-327756.5Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field valuCVE-2021-327768.8Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on WinCVE-2021-327778.3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when e
CVE-2021-32766: Medium severity, CVSS 5.3 | Vulnix