What’s Vulnerable › Vulnerabilities

CVE-2016-9459

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-03-28 · updated 2026-06-17
• Weakness: CWE-209

Description

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.

Affected products

• Nextcloud Server: before 9.0.52 — fixed in 9.0.52
• Owncloud: before 9.0.4 — fixed in 9.0.4

How to fix

Upgrade to a fixed version: Nextcloud Server 9.0.52; Owncloud 9.0.4. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/97284
• https://github.com/nextcloud/server/commit/94975af6db1551c2d23136c2ea22866a5b416070
• https://github.com/owncloud/core/commit/044ee072a647636b1a17c89265c7233b35371335
• https://github.com/owncloud/core/commit/b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1
• https://github.com/owncloud/core/commit/efa35d621dc7ff975468e636a5d1c153511296dc
• https://hackerone.com/reports/146278
• https://nextcloud.com/security/advisory/?id=nc-sa-2016-002
• https://owncloud.org/security/advisory?id=oc-sa-2016-012
• http://www.securityfocus.com/bid/97284
• https://github.com/nextcloud/server/commit/94975af6db1551c2d23136c2ea22866a5b416070
• https://github.com/owncloud/core/commit/044ee072a647636b1a17c89265c7233b35371335
• https://github.com/owncloud/core/commit/b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1

Get alerted when CVE-2016-9459 or the next vulnerability affects your stack