CVE-2021-32734

5.3 mediumEPSS 1.4%

Medium (5.3) in nextcloud nextcloud server. EPSS 1.4% chance of exploitation in the next 30 days.

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud Text application in Nextcloud Server app settings.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-209
Published: 2021-07-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:nextcloud_server

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6hf5-c2c4-2526
https://github.com/nextcloud/text/pull/1695
https://hackerone.com/reports/1246721
https://security.gentoo.org/glsa/202208-17
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6hf5-c2c4-2526

Check your stack JSON