CVE-2021-41233

    Dashboard / Vulnerabilities / CVE-2021-41233

    CVE-2021-41233

    Published: 10 Mar 2022Last Modified: 24 Oct 2026

    Summary:

    Details: Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an attacker requires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud Server to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the Nextcloud Text application in the application settings.

    References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-26c8-35cm-xq9m, https://github.com/nextcloud/text/pull/1884

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -50221f94abea4f26710091d94f2930a0322036bc

    Affected versions

    v20.0.14rc1
    v20.0.13
    v20.0.13rc1
    v20.0.11
    v20.0.11rc1
    v20.0.10
    v20.0.10RC1
    v20.0.9
    v20.0.9RC1
    v20.0.8
    v20.0.8RC1
    v20.0.7RC1
    v20.0.7
    v20.0.6
    v20.0.6RC1
    v20.0.5
    v20.0.5RC2
    v20.0.5RC1
    v20.0.4
    v20.0.3
    v20.0.3RC2
    v20.0.2
    v20.0.2RC2
    v20.0.2RC1
    v20.0.1
    v20.0.1RC1
    v20.0.0
    v20.0.0RC2
    v20.0.0RC1
    v20.0.0beta4
    v20.0.0beta3
    v20.0.0beta2
    v20.0.0beta1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41233 | CVE-DB