CVE-2021-43863

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFileProvider` have security issues (an SQL injection, and an insufficient permission control, respectively) that allow malicious apps in the same device to access Nextcloud's data bypassing the permission control system. Users should upgrade to version 3.18.1 to receive a patch. There are no known workarounds aside from upgrading.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jan 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-43878.8The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to miCVE-2021-438757.8Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2021-438768.8Microsoft SharePoint Elevation of Privilege VulnerabilityCVE-2021-438778.8ASP.NET Core and Visual Studio Elevation of Privilege VulnerabilityCVE-2021-43885.3The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due CVE-2021-438805.5Windows Mobile Device Management Elevation of Privilege VulnerabilityCVE-2021-438829.8Microsoft Defender for IoT Remote Code Execution VulnerabilityCVE-2021-438837.8Windows Installer Elevation of Privilege VulnerabilityCVE-2021-438887.5Microsoft Defender for IoT Information Disclosure VulnerabilityCVE-2021-438897.2Microsoft Defender for IoT Remote Code Execution VulnerabilityCVE-2021-43894.3The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missiCVE-2021-438907.1We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks tha
CVE-2021-43863: High severity, CVSS 7.5 | Vulnix