Nextcloud Files Confidential CVE-2026-77173

Requires an authenticated Nextcloud user (PR:L) on an instance running the Files Confidential app (versions 3.3.0 through ≤5.0.0) with its content-based confidential marking enabled. The specific trigger is naming a docx or odt file so the filename contains a '#' character, which causes the app to skip marking the file as confidential; no additional user interaction is needed (UI:N) and complexity is low (AC:L). Limiting factors: exploitation only matters where the Files Confidential app is deployed and relied upon as a control, the attacker must already have a valid account and file-upload ability, and impact is confined to this app's classification behavior (C:L, no integrity/availability impact).

This is a low-to-moderate, access-control weakness (CWE-284) in the Nextcloud 'Files Confidential' app, where naming a docx/odt file with a '#' causes content-based confidential classification to be skipped so sensitive data (e.g. a credit card number) goes unmarked. The supplied CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) indicates a network-reachable, low-complexity action by an authenticated user (PR:L) with limited confidentiality impact and no integrity or availability impact. No EPSS score and no CISA KEV listing were provided, and there is no indication of active exploitation; the vuln.today decision label is 'this_month' (routine patch cadence, not act_now/emergency), consistent with a real-but-non-urgent fix. The 'Authentication Bypass' tag overstates the nature of the issue: the PR:L vector and description describe an already-authenticated user evading a content-classification/DLP control, not bypassing authentication - treat the tag with caution. A reference to a HackerOne report exists but is not confirmed as working exploit code, so exploit availability is best described as a PoC reference rather than weaponized code. Net: a legitimate confidentiality-control-evasion bug worth patching on a normal cycle, not a high-urgency, widely-exploited threat.

An authenticated Nextcloud user who wants to smuggle sensitive data past the Files Confidential classifier creates a docx or odt document containing a credit card number and simply includes a '#' character in the filename; the file is then not flagged as confidential and escapes the app's protective handling. A HackerOne report reference exists describing the issue, but it is not verified as working exploit code. Given AC:L and no required user interaction, the action is trivial for any user able to upload files.