What is the CVSS score of CVE-2026-45279?

CVE-2026-45279 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45279?

Yes, a patch is available for CVE-2026-45279. Update the affected software to the latest version immediately.

Nextcloud CVE-2026-45279

Q: Which versions of Nextcloud are affected by CVE-2026-45279?

{lang}` placeholder in the template directory config value. The root cause is insufficient sanitization of the `forceLanguage` HTTP request parameter and the `ACCEPT_LANGUAGE` header in…. A patch is available.

EUVD-2026-33705 MEDIUM

Path Traversal (CWE-22)

2026-06-01 GitHub_M

Path Traversal Nextcloud

4.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 19:33 vuln.today

Analysis Generated

Jun 01, 2026 - 19:33 vuln.today

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is upgraded to 32.0.4, 31.0.14. It is recommended that the Nextcloud Enterprise Server is upgraded to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15

AnalysisAI

Path traversal in Nextcloud Server 31.x and 32.x allows authenticated non-admin users to copy arbitrary server-side files into their own Nextcloud storage directory when an administrator has configured the {lang} placeholder in the template directory config value. The root cause is insufficient sanitization of the forceLanguage HTTP request parameter and the ACCEPT_LANGUAGE header in lib/private/L10N/Factory.php, which were used unsanitized in filesystem path construction. No public exploit identified at time of analysis, though a HackerOne report (3468140) exists; CVSS scores this as Medium (4.4) due to high complexity and privilege preconditions, and impact is limited to confidentiality with no code execution possible.