What’s Vulnerable › Vulnerabilities

CVE-2016-9467

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-03-28 · updated 2026-06-17
• Weakness: CWE-451

Description

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.

Affected products

• Nextcloud Server: before 9.0.54; from 10.0.0 before 10.0.1 — fixed in 10.0.1, 9.0.54
• Owncloud: from 9.0.0 before 9.0.6; from 9.1.0 before 9.1.2 — fixed in 9.0.6, 9.1.2

How to fix

Upgrade to a fixed version: Nextcloud Server 10.0.1, 9.0.54; Owncloud 9.0.6, 9.1.2. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/server/commit/1352365e8bf5ea49da3dc82b1ccf7ddb659ae960
• https://github.com/nextcloud/server/commit/5dd211cc8845fd4533966bf8d7a7f2a6359ea013
• https://github.com/nextcloud/server/commit/778ae8abd54c378fc4781394bbedc7a2ee3095e1
• https://github.com/nextcloud/server/commit/c3ae21fef2880c9fe44e8fdbe1262ac7f9716f14
• https://github.com/nextcloud/server/commit/df50e967dbd27b13875625b7dd3189294619b071
• https://github.com/nextcloud/server/commit/ed0f0db5fa0aff04594cb0f973ae4c22b17a175a
• https://github.com/owncloud/core/commit/768221fcf3c526c65d85f62b0efa2da5ea00bf2d
• https://github.com/owncloud/core/commit/e7acbce27fa0ef1c6fe216ca67c72d86484919a4
• https://hackerone.com/reports/154827
• https://nextcloud.com/security/advisory/?id=nc-sa-2016-010
• https://owncloud.org/security/advisory/?id=oc-sa-2016-020
• https://github.com/nextcloud/server/commit/1352365e8bf5ea49da3dc82b1ccf7ddb659ae960

Get alerted when CVE-2016-9467 or the next vulnerability affects your stack