CVE-2021-32802 is a critical vulnerability affecting Nextcloud server, an open-source self-hosted personal cloud solution. It arises from the server's use of an unsuitable third-party library for image preview rendering of untrusted user-supplied content. This flaw carries a CVSS score of 9.8 (Critical) due to its potential for Server-Side Request Forgery, file disclosure, or remote code execution, with a low attack complexity and no user interaction required. While there is no known active exploitation, public exploit code, or significant community discussion, immediate patching to versions 20.0.12, 21.0.4, or 22.1.0, or disabling previews, is strongly recommended.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 20.0.12CPE matchmatch criteria | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | ||
>= 21.0.0, < 21.0.4CPE matchmatch criteria | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | ||
>= 22.0.0, < 22.1.0CPE matchmatch criteria | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.