Skip to content
Fencer Vulns
low 3.5

CVE-2021-32655 json

Files Drop public link can be added as federated share

published 2021-06-01 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-19475

cvss
3.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and tries to remove the "Create" privileges of this unexpected share, Nextcloud server would silently grant the share read privileges. The vulnerability is patched in versions 19.0.11, 20.0.10 and 21.0.2. No workarounds are known to exist.

Patch / fix

  • nextcloud nextcloud_server 19.0.11, 20.0.10, 21.0.2
  • nextcloud Arch Linux 21.0.2-1

arch linux advisories AVG-2024

Exploit prediction

1.03% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
NVD 3.1 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N

Affected products

  • nextcloud security-advisories

Classification

Weakness
  • CWE-241 Improper Handling of Unexpected Data Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.