The vulnerability is a SQL injection flaw in the Tables app that allows an authenticated attacker to inject up to 20‑byte SQL statements via a stored column type parameter. When carefully crafted, this injection can bypass the length restriction and lead to execution of arbitrary SQL commands, potentially exposing or modifying sensitive data in the Nextcloud database. The weakness is classified as CWE‑89, reflecting its reliance on inadequate input validation when forming SQL queries.

Nextcloud servers running any of the affected releases: 0.7.0 through 0.7.6, 0.8.0 through 0.8.9, 0.9.0 through 0.9.7, 1.0.0 through 1.0.3, and any 2.0.0‑earlier build before 2.0.0. Versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0 or later contain the fix, removing the injection vector.

The CVSS score of 8.2 indicates high severity, and the lack of an EPSS score means the likelihood of exploitation is uncertain, but the flaw’s use of a short but versatile SQL payload raises concern. The vulnerability is only exploitable by users who are authenticated and have permission to use the Tables app, implying an internal or privileged‑user threat model. The flaw is not listed in CISA’s KEV catalogue, yet the potential for data exfiltration or tampering warrants urgent attention.