What’s Vulnerable › Vulnerabilities

CVE-2023-35173: End-to-End encrypted file-drops can be made inaccessible

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-23 · updated 2026-06-17
• Weakness: CWE-284

Description

Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded to version 1.12.4 that contains the fix.

Affected products

• Nextcloud End-to-End Encryption: from 1.12.0 before 1.12.4 — fixed in 1.12.4

How to fix

Upgrade to a fixed version: Nextcloud End-to-End Encryption 1.12.4. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/end_to_end_encryption/pull/435
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x7c7-v5r3-mg37
• https://hackerone.com/reports/1914115
• https://github.com/nextcloud/end_to_end_encryption/pull/435
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x7c7-v5r3-mg37
• https://hackerone.com/reports/1914115

Get alerted when CVE-2023-35173 or the next vulnerability affects your stack