CVE-2021-41178

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishing attack, an attacker could upload a malicious SVG file that mimics the Nextcloud login form and send a specially crafted link to victims. The XSS risk here is mitigated due to the fact that Nextcloud employs a strict Content-Security-Policy disallowing execution of arbitrary JavaScript. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-23 CWE-434 CWE-22

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	20.0.13; >= 21.0.0, < 21.0.5; < 22.2.0

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jp9c-vpr3-m5rfThird Party Advisory
https://github.com/nextcloud/server/pull/28726Patch, Third Party Advisory
https://hackerone.com/reports/1302155Permissions Required
https://security.gentoo.org/glsa/202208-17Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jp9c-vpr3-m5rfThird Party Advisory
https://github.com/nextcloud/server/pull/28726Patch, Third Party Advisory
https://hackerone.com/reports/1302155Permissions Required
https://security.gentoo.org/glsa/202208-17Third Party Advisory

Timeline

Published: Oct 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411796.5Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Fact CVE-2021-41187.8pytorch-lightning is vulnerable to Deserialization of Untrusted Data CVE-2021-411806.1Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation previe CVE-2021-411812.4Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly dete CVE-2021-411826.1jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepi CVE-2021-411836.1jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Date CVE-2021-411846.1jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()CVE-2021-411856.5Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints t CVE-2021-411867.5Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin i CVE-2021-411878.8DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerabilit CVE-2021-411885.4Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in CVE-2021-411897.2DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permis