What’s Vulnerable › Vulnerabilities

CVE-2022-39211: Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-16 · updated 2026-06-17
• Weakness: CWE-918

Description

Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.

Affected products

• Nextcloud Enterprise Server: before 22.2.10.4; from 23.0.0 before 23.0.8; from 24.0.0 before 24.0.4 — fixed in 22.2.10.4, 23.0.8, 24.0.4
• Nextcloud Server: before 23.0.8; from 24.0.0 before 24.0.4 — fixed in 23.0.8, 24.0.4

How to fix

Upgrade to a fixed version: Nextcloud Enterprise Server 22.2.10.4, 23.0.8, 24.0.4; Nextcloud Server 23.0.8, 24.0.4. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8
• https://github.com/nextcloud/server/pull/32988
• https://github.com/nextcloud/server/pull/33031
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8
• https://github.com/nextcloud/server/pull/32988
• https://github.com/nextcloud/server/pull/33031

Get alerted when CVE-2022-39211 or the next vulnerability affects your stack