VULNERABILITY INTELLIGENCE

CVE-2022-39210

CVSS score3.2 LOW

EPSS probability0.31%

CISA KEVNot currently listed

Published2022-09-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Description

Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possible. This may lead to a leak of sensitive information in some cases. It is recommended that the Nextcloud Android app is upgraded to 3.21.0. There are no known workarounds for this issue.

Weakness classification

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

security-advisories@github.com — Patch, Third Party Advisory
security-advisories@github.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory