CVE-2026-45157: Nextcloud Server Information Disclosure

CVE-2026-45157 Overview

CVE-2026-45157 is an improper access control vulnerability [CWE-284] in Nextcloud Server affecting the chunked upload mechanism. A malicious user who has access to a file share can reuse the share token to directly access the chunking upload endpoint. This exposes temporary part files belonging to the share owner during in-progress uploads. The flaw affects Nextcloud Server versions 32.0.0 through 32.0.8 and 33.0.0 through 33.0.2, along with multiple Enterprise Server branches. Successful exploitation requires an authenticated share recipient and user interaction with the share workflow.

Critical Impact
Authenticated share recipients can read confidential in-flight upload chunks belonging to the share owner, exposing partial file contents during active uploads.

Affected Products

Nextcloud Server 32.0.0 through 32.0.8
Nextcloud Server 33.0.0 through 33.0.2
Nextcloud Enterprise Server branches 26.0.x, 27.1.x, 28.0.x, 29.0.x, 30.0.x, 31.0.x, 32.0.x, 33.0.x prior to listed fixes

Discovery Timeline

2026-06-01 - CVE-2026-45157 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-45157

Vulnerability Analysis

Nextcloud supports chunked uploads to handle large files reliably. The server stores temporary part files in an upload directory associated with the uploading user. The flaw resides in how the chunking upload endpoint authorizes access when a share token is presented. The endpoint accepts share tokens for chunked upload access without validating that the token holder owns the in-progress upload session. As a result, any user holding a valid share token for the target file share can enumerate and retrieve temporary chunk files belonging to the share owner. This breaks the confidentiality boundary expected between a share owner and a share recipient.

Root Cause

The root cause is improper access control [CWE-284] on the chunked upload directory. The server treats share token possession as sufficient authorization to enumerate upload part files. It does not separately verify that the requester initiated the upload session being read.

Attack Vector

The attack requires network access, low privileges, and user interaction tied to the share workflow. An attacker who has been granted access to a file share authenticates with their existing share token. The attacker then issues requests against the chunked upload endpoint using that token to read temporary part files written by the share owner. Refer to the GitHub Security Advisory GHSA-45pj-p7x7-4mhc and the HackerOne Report #3483708 for additional technical detail.

Detection Methods for CVE-2026-45157

Indicators of Compromise

Requests from share recipients to chunked upload endpoints (/remote.php/dav/uploads/) referencing upload sessions they did not initiate.
Unusual PROPFIND or GET activity against the uploads namespace correlated with active share token sessions.
Access patterns where a single share token reads multiple distinct in-progress chunked upload directories.

Detection Strategies

Audit Nextcloud web server access logs for requests to the chunked upload path that include a share token query parameter or header.
Correlate the authenticated user identifier on chunked upload requests against the owning user of the upload session.
Alert when share-token authenticated sessions enumerate part files outside the share recipient's own upload context.

Monitoring Recommendations

Forward Nextcloud reverse proxy and PHP application logs to a centralized analytics platform for behavioral baselining.
Track the ratio of chunked upload reads to writes per share token to surface anomalous read-only enumeration.
Monitor Nextcloud audit log entries for share access events occurring in close time proximity to upload activity by the share owner.

How to Mitigate CVE-2026-45157

Immediate Actions Required

Upgrade Nextcloud Server to version 32.0.9 or 33.0.3 as soon as a maintenance window permits.
Upgrade Nextcloud Enterprise Server to 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9, or 33.0.3 depending on the deployed branch.
Review existing share recipients on sensitive folders and revoke unnecessary shares until patching is complete.

Patch Information

The fix is delivered through the upstream commit referenced in Nextcloud server pull request #59780. The patch enforces that share token holders cannot access chunked upload part files belonging to other users. Administrators should validate the installed version with occ status after upgrade and confirm the running version matches a fixed release.

Workarounds

Disable or restrict chunked uploads on internet-facing instances until the patch is applied, accepting the impact on large file uploads.
Limit share creation to trusted users and disable public link sharing for directories receiving sensitive uploads.
Place the Nextcloud upload endpoints behind a reverse proxy rule that requires session authentication beyond share token presentation.

bash

# Verify Nextcloud version after upgrade
sudo -u www-data php /var/www/nextcloud/occ status

# Review active shares for sensitive folders
sudo -u www-data php /var/www/nextcloud/occ files_external:list
sudo -u www-data php /var/www/nextcloud/occ share:list