CVE-2022-24888

    Dashboard / Vulnerabilities / CVE-2022-24888

    CVE-2022-24888

    Published: 27 Apr 2022Last Modified: 12 Aug 2026

    Summary: Possible Injection in Nextcloud Server

    Details: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. This issue is fixed in versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1. There are currently no known workarounds.

    References: https://hackerone.com/reports/1402249, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24888.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w3h6-p64h-q9jp, https://nvd.nist.gov/vuln/detail/CVE-2022-24888, https://security.gentoo.org/glsa/202208-17, https://github.com/nextcloud/server/pull/29895

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8985b7930653139859002eb3eca2852999ed8f0d
    Fixed -2721bbb5da8a9abb9a8ee610181315ad9b6b8ba8

    Affected versions

    v21.0.8rc3
    v21.0.8rc2
    v21.0.8rc1
    v21.0.7
    v21.0.6
    v21.0.6rc1
    v21.0.5
    v21.0.5rc1
    v21.0.4
    v21.0.4rc1
    v21.0.3
    v21.0.3rc1
    v21.0.2
    v21.0.2RC1
    v21.0.1
    v21.0.1RC1
    v21.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24888 | CVE-DB