Impact

The File Drop features ("Upload Only" public link shares in Nextcloud) can be bypassed using the Nextcloud Richdocuments app. An attacker was able to read arbitrary files in such a share.

Patches

It is recommended that the Nextcloud Richdocuments is upgraded to 3.8.4 or 4.2.1.

Workarounds

Disable the Richdocuments application.

References

• HackerOne
• Pull Request

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com