CVE-2026-45157
Description
A flaw was found in Nextcloud Server. A malicious user with access to a file share could exploit this vulnerability by using the share token to directly access the chunking upload process. This allows the attacker to view temporary part files during ongoing uploads, leading to information disclosure. This issue could expose sensitive data being uploaded by other users.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
If the temporary file can be read by the attacker, sensitive information may be in that file which could be revealed.
Authorization,Other
Technical Impact: Other
If that file can be written to by the attacker, the file might be moved into a place to which the attacker does not have access. This will allow the attacker to gain selective resource access-control privileges.
Integrity,Other
Technical Impact: Other
Depending on the data stored in the temporary file, there is the potential for an attacker to gain an additional input vector which is trusted as non-malicious. It may be possible to make arbitrary changes to data structures, user information, or even process ownership.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
