What’s Vulnerable › Vulnerabilities

CVE-2022-31024: Federated editing allows iframing remote servers by default in richdocuments

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-02 · updated 2026-06-17
• Weakness: CWE-284

Description

richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be tricked into working against a remote Office by sending them a federated share. richdocuments versions 6.0.0, 5.0.4 and 4.2.6 contain a fix for this issue. There are currently no known workarounds available.

Affected products

• nextcloud Richdocuments: before 4.2.6; from 5.0.0 before 5.0.4; 6.0.0-beta1 — fixed in 4.2.6, 5.0.4

How to fix

Upgrade to a fixed version: nextcloud Richdocuments 4.2.6, 5.0.4. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/richdocuments/pull/2161
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-94hr-7g4v-f53r
• https://hackerone.com/reports/1210424
• https://github.com/nextcloud/richdocuments/pull/2161
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-94hr-7g4v-f53r
• https://hackerone.com/reports/1210424

Get alerted when CVE-2022-31024 or the next vulnerability affects your stack