Nextcloud's Files Confidential feature fails to mark documents that contain a hash character (#) in the filename as confidential. Consequently, a user can upload a docx or odt file that carries sensitive information such as a credit card number, and the system will not enforce confidentiality protections. The flaw is a form of Improper Access Control, allowing private data to be exposed or accessed without the intended restrictions.

The vulnerability affects the Nextcloud Files Confidential component. No specific version is listed, so all deployments of this feature may be vulnerable.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is not in CISA's KEV catalog. Exploitability is low to moderate; an attacker would need the ability to upload files to the server and name them with a hash character. The likely attack vector is user‑controlled file uploads, inferred from the nature of the flaw.