What’s Vulnerable › Vulnerabilities

CVE-2019-12739

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-06-05 · updated 2026-06-17
• Weakness: CWE-78

Description

lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters).

Affected products

• nextcloud Extract: before 1.2.0 — fixed in 1.2.0

How to fix

Upgrade to a fixed version: nextcloud Extract 1.2.0. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/546753
• https://www.secsignal.org/news/a-tale-of-rce-nextcloud-extract-app/
• https://hackerone.com/reports/546753
• https://www.secsignal.org/news/a-tale-of-rce-nextcloud-extract-app/

Get alerted when CVE-2019-12739 or the next vulnerability affects your stack