What’s Vulnerable › Vulnerabilities

CVE-2022-36075: File list exposure in Nextcloud Files Access Control

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-15 · updated 2026-06-17
• Weakness: CWE-200

Description

Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextcloud Files Access Control app is upgraded to 1.12.2, 1.13.1 or 1.14.1. There are no known workarounds for this issue

Affected products

• nextcloud Files Access Control: before 1.12.2; 1.13.0, 1.14.0 — fixed in 1.12.2

How to fix

Upgrade to a fixed version: nextcloud Files Access Control 1.12.2. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/files_accesscontrol/pull/248
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4m73-g7v7-v62w
• https://github.com/nextcloud/files_accesscontrol/pull/248
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4m73-g7v7-v62w

Get alerted when CVE-2022-36075 or the next vulnerability affects your stack