Technical impact
The vulnerability allows a malicious user who possesses a files drop link to upload files into any other end‑to‑end encrypted folder owned by the link’s target, even though the user cannot read or modify those files. This bypasses the intended isolation of encrypted folders and is classified as CWE‑639, a privilege‑escalation via insufficient access control.
Affected Systems
Affected versions are Nextcloud 1.15.0‑1.15.3, 1.16.0‑1.16.2, 1.17.0‑1.17.0, and 1.18.0‑1.18.0. The issue was fixed in 1.15.4, 1.16.3, 1.17.1, 1.18.1, and the release candidate 2.0.0‑rc.7 and later.
Risk and Exploitability
The CVSS score of 3.5 indicates low to moderate severity, and the vulnerability requires only possession of a valid files drop link, which can be easily shared. An attacker does not need any special privileges or knowledge beyond the link, so the attack vector is remote via the web interface. Although the exploit does not grant read access to other users’ files, it permits an attacker to inject malicious or misleading content into encrypted folders. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, suggesting limited known exploitation.
