What’s Vulnerable › Vulnerabilities

CVE-2026-45722: Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-01 · updated 2026-07-22
• Weakness: CWE-89

Description

Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or to make the database wait for a given time. This issue has been patched in versions 0.9.7 and 1.0.2.

Affected products

• nextcloud Tables: from 0.9.0 before 0.9.7; from 1.0.0 before 1.0.2 — fixed in 0.9.7, 1.0.2

How to fix

Upgrade to a fixed version: nextcloud Tables 0.9.7, 1.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5h2w-c7px-hp4j
• https://github.com/nextcloud/tables/pull/2186
• https://hackerone.com/reports/3446689

Get alerted when CVE-2026-45722 or the next vulnerability affects your stack