CVE-2022-39210

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possible. This may lead to a leak of sensitive information in some cases. It is recommended that the Nextcloud Android app is upgraded to 3.21.0. There are no known workarounds for this issue.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22 CWE-200

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 3.21.0

References

https://github.com/nextcloud/android/pull/10544Patch, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw2w-gpcv-v39fThird Party Advisory
https://github.com/nextcloud/android/pull/10544Patch, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw2w-gpcv-v39fThird Party Advisory

Timeline

Published: Sep 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392115.3Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found CVE-2022-392125.3Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected versions an attacker could see the CVE-2022-392137.5go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS). In affected versions when a full CVSS v2.0 vector string is CVE-2022-392147.5Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop CVE-2022-392155.8Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursi CVE-2022-392169.8Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is g CVE-2022-392179.8some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it i CVE-2022-392187.5The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge Jav CVE-2022-392196.5Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prio CVE-2022-39224.8The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege CVE-2022-392206.1SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebC CVE-2022-392217.5McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod fo