Files Confidential
Monthly
Nextcloud Files Confidential (versions 3.3.0 through 5.0.0) fails to apply its content-based confidential classification when an uploaded docx or odt file has a '#' character in the filename, allowing an authenticated user to store sensitive content such as a credit card number without it being marked confidential. The flaw is a low-severity access-control weakness (CVSS 4.3, confidentiality-only impact, AV:N/AC:L/PR:L/UI:N) that matters only where the app is deployed and relied upon as a marking control; exploitation requires a valid account and upload capability. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vuln.today priority is this_month.
Nextcloud Files Confidential (versions 3.3.0 through 5.0.0) fails to apply its content-based confidential classification when an uploaded docx or odt file has a '#' character in the filename, allowing an authenticated user to store sensitive content such as a credit card number without it being marked confidential. The flaw is a low-severity access-control weakness (CVSS 4.3, confidentiality-only impact, AV:N/AC:L/PR:L/UI:N) that matters only where the app is deployed and relied upon as a marking control; exploitation requires a valid account and upload capability. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vuln.today priority is this_month.