CVE-2026-45279 Overview
CVE-2026-45279 is a path traversal vulnerability [CWE-22] in Nextcloud Server affecting versions 31.0.0 to before 31.0.14 and 32.0.0 to before 32.0.4. The flaw occurs when the {lang} placeholder is used in the template directory configuration value. Non-admin users can copy arbitrary files into their own Nextcloud directory through directory traversal, constrained only by underlying unix file permissions. Nextcloud Enterprise Server is also affected across multiple branches. The issue allows authenticated users to read files outside their intended scope, leading to information disclosure of server-side content.
Critical Impact
Authenticated non-admin users can exfiltrate arbitrary files readable by the Nextcloud process via path traversal in the template directory {lang} substitution.
Affected Products
- Nextcloud Server 31.0.0 to before 31.0.14
- Nextcloud Server 32.0.0 to before 32.0.4
- Nextcloud Enterprise Server 28.0.x, 29.0.x, 30.0.x, 31.0.x, 32.0.x prior to patched releases
Discovery Timeline
- 2026-06-01 - CVE-2026-45279 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-45279
Vulnerability Analysis
The vulnerability resides in how Nextcloud Server expands the {lang} placeholder inside the template directory configuration. When an administrator configures a template directory containing this token, the application substitutes the user's language code at runtime. The substitution does not sanitize traversal sequences, allowing a manipulated language value to resolve to paths outside the intended template directory.
An authenticated non-admin user can leverage this expansion to instruct Nextcloud to copy files from arbitrary filesystem locations into their personal Nextcloud directory. The copy operation runs with the privileges of the Nextcloud web process. Any file readable by that process becomes retrievable through the user's normal file interface. The attack does not require user interaction beyond standard account access.
Root Cause
The root cause is insufficient input validation on the language identifier used to expand the {lang} placeholder during template directory resolution. The path construction routine concatenates user-influenced data into a filesystem path without canonicalizing or rejecting .. sequences. This violates safe path handling practices defined by [CWE-22].
Attack Vector
An attacker requires a valid low-privilege Nextcloud account on an instance where the administrator has set a template directory configuration containing {lang}. The attacker triggers the template copy workflow with a language value crafted to traverse the filesystem hierarchy. Successful exploitation copies the targeted file into the attacker's own Nextcloud storage, where it can be downloaded normally. Exploitation is constrained by unix permissions on the Nextcloud process account.
No public proof-of-concept code is currently available. Refer to the GitHub Security Advisory GHSA-j33j-qph5-4wch and HackerOne Report #3468140 for technical detail.
Detection Methods for CVE-2026-45279
Indicators of Compromise
- Unexpected files appearing in user Nextcloud directories that match server-side paths such as /etc/, application config directories, or other users' data paths
- Nextcloud audit log entries showing template copy actions with anomalous or traversal-style language identifiers
- File access events on the Nextcloud host targeting paths outside the configured data directory by the web process
Detection Strategies
- Review the skeletondirectory and templatedirectory configuration values in config.php for any use of the {lang} token
- Inspect web server and Nextcloud application logs for requests setting unusual locale or language parameters during account provisioning or template copy operations
- Correlate filesystem access by the PHP-FPM or web server user against the expected Nextcloud data root
Monitoring Recommendations
- Enable Nextcloud's loglevel 1 or lower and centralize logs for audit review
- Monitor process-level file access using auditd or eBPF-based tooling for reads outside /var/www or the configured data directory
- Alert on creation of files in user directories that mirror sensitive system paths
How to Mitigate CVE-2026-45279
Immediate Actions Required
- Upgrade Nextcloud Server to version 32.0.4 or 31.0.14
- Upgrade Nextcloud Enterprise Server to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, or 28.0.14.15
- Remove the {lang} token from any templatedirectory configuration value until patches are applied
- Audit user-accessible directories for files copied from outside the intended template paths
Patch Information
Nextcloud released patches addressing the path traversal in the template directory expansion logic. Code changes are published in Nextcloud Server Pull Request #57414. The advisory metadata and fix matrix are documented in the Nextcloud Security Advisory GHSA-j33j-qph5-4wch.
Workarounds
- Remove {lang} from the template directory configuration value in config.php and restart the Nextcloud service
- Restrict filesystem permissions on the Nextcloud web process account to limit readable paths outside the data directory
- Disable template directory functionality entirely if not in use by leaving the configuration option unset
# Configuration example - remove {lang} from templatedirectory in config.php
sudo -u www-data php /var/www/nextcloud/occ config:system:get templatedirectory
sudo -u www-data php /var/www/nextcloud/occ config:system:delete templatedirectory
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
