3Dviewer Nextcloud
Monthly
Password-protected link shares in the 3D Viewer for Nextcloud app (versions 1.7.9 through 3.3.1) can be read without any password or session by anyone who knows the share token, via GET /ocs/v2.php/apps/threedviewer/public/file/{token}/{fileId}. The app's public controller was not a Nextcloud PublicShareController, so the framework's PublicShareMiddleware returned early and never enforced the share password, expiry, or share type; requests returned 200 with the full file body for shares whose normal Nextcloud share page still prompted for a password. Exposure is limited to files in the 3D formats the app handles (STL, GLB/glTF, OBJ, STEP, IFC and similar); non-3D files in the same share are unaffected and expired shares return 500 rather than leaking content. No public exploit code was identified at time of analysis; the vendor fixed the issue in 3.3.2.
Password-protected link shares in the 3D Viewer for Nextcloud app (versions 1.7.9 through 3.3.1) can be read without any password or session by anyone who knows the share token, via GET /ocs/v2.php/apps/threedviewer/public/file/{token}/{fileId}. The app's public controller was not a Nextcloud PublicShareController, so the framework's PublicShareMiddleware returned early and never enforced the share password, expiry, or share type; requests returned 200 with the full file body for shares whose normal Nextcloud share page still prompted for a password. Exposure is limited to files in the 3D formats the app handles (STL, GLB/glTF, OBJ, STEP, IFC and similar); non-3D files in the same share are unaffected and expired shares return 500 rather than leaking content. No public exploit code was identified at time of analysis; the vendor fixed the issue in 3.3.2.