CVE-2024-22404

    Dashboard / Vulnerabilities / CVE-2024-22404

    CVE-2024-22404

    Published: 18 Jan 2024Last Modified: 12 Aug 2026

    Summary: Permissions bypass in Nextcloud with the files zip app

    Details: Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.

    References: https://hackerone.com/reports/2247457, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22404.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq, https://nvd.nist.gov/vuln/detail/CVE-2024-22404, https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 75c11bd4ba72a9b0175250746606b7ea79e5577b
    Fixed -2ddc39aece037fc947c639062ea9c2a9727975c3

    Affected versions

    1.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-22404 | CVE-DB