This vulnerability allows an attacker who has a share token to view the temporary chunk files that are created during a file upload by another user. The flaw is a result of improper authorization (CWE-284) and lets the attacker observe data that should only be accessible to the file owner while the upload is in progress. The impact is a confidentiality compromise of transient data, potentially revealing sensitive information such as filenames and partial file contents.

Affected products include Nextcloud Server versions 32.0.0 through 32.0.8 and 33.0.0 through 33.0.2, as well as Nextcloud Enterprise Server versions 26.0.13.26, 27.1.11.25, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9, and 33.0.3. Upgrading to the listed patched releases removes the flaw.

The CVSS score of 6.3 classifies this as a moderate severity flaw, and the EPSS score is not available, which means the probability of exploitation is currently unknown but could be nontrivial given the easy acquisition of share tokens. The flaw is not listed in the CISA KEV catalog. An attacker can exploit it by using an existing share token to access the chunking upload endpoint and download the temporary files. No additional authentication or privilege escalation is required beyond possession of the share token.