A path traversal vulnerability exists in the template API of Nextcloud Server when the {lang} placeholder is used in the template directory configuration. The flaw allows non‑administrative users to copy arbitrary files, subject to Unix permissions, into their own Nextcloud directory. This can provide unauthorized access to files that are not meant to be read or manipulated by ordinary users, potentially exposing sensitive data. The weakness is categorized as CWE‑22 – Path Traversal.

Nextcloud Server versions from 31.0.0 up to (but not including) 31.0.14, and from 32.0.0 up to (but not including) 32.0.4 are affected. Enterprise Server builds prior to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, and 28.0.14.15 also contain the flaw and should be upgraded to the corresponding patched releases.

The CVSS score of 4.4 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user to be logged into Nextcloud with non‑admin privileges and configure the template directory to include the {lang} placeholder. No public exploit has been reported, and the attack is limited to file copying rather than remote code execution. Overall risk is moderate, but the potential for data leakage warrants timely remediation.