CVE-2021-32802

    Dashboard / Vulnerabilities / CVE-2021-32802

    CVE-2021-32802

    Published: 7 Sept 2021Last Modified: 7 Aug 2026

    Summary:

    Details: Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several security concerns with passing user-generated content to this library, such as Server-Side-Request-Forgery, file disclosure or potentially executing code on the system. The risk depends on your system configuration and the installed library version. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. These versions do not use this library anymore. As a workaround users may disable previews by setting `enable_previews` to `false` in `config.php`.

    References: https://docs.nextcloud.com/server/21/admin_manual/configuration_files/previews_configuration.html#disabling-previews, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m682-v4g9-wrq7, https://security.gentoo.org/glsa/202208-17, https://hackerone.com/reports/1261413

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a09a7fc6ae1c18aeba4fef5775a670aea8003890

    Affected versions

    20.0.12rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32802 | CVE-DB