Potential directory traversal in OC\Files\Node\Folder::getFullPath
Package
Server
(Nextcloud)
Affected versions
<25.0.2, < 24.0.8, < 23.0.12
Patched versions
25.0.2, 24.0.8, 23.0.12
Server (Enterprise)
(Nextcloud)
<25.0.2, < 24.0.8, < 23.0.12, < 22.2.10, < 21.0.9, < 20.0.14
25.0.2, 24.0.8, 23.0.12, 22.2.10.10, 21.0.9.10, 20.0.14.12
Description
Credits
-
nickvergessen Analyst
Impact
OC\Files\Node\Folder::getFullPath() is validating and normalizing the string in the wrong order.
The function seems to be used in newFile() and newFolder() items, allowing to create paths outside of ones own space and overwriting data from other users.
Patches
It is recommended that the Nextcloud Server is upgraded to 25.0.2, 24.0.8, 23.0.12,
It is recommended that the Nextcloud Enterprise Server is upgraded to 25.0.2, 24.0.8, 23.0.12, 22.2.10.10, 21.0.9.10, 20.0.14.12
Workarounds
No workaround available
References
For more information
If you have any questions or comments about this advisory: