Preview generation used third-party library not suited for user-generated content in Nextcloud server

published 2021-09-07 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-19562

cvss: 9.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.6%; EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits: 0; none known

Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several security concerns with passing user-generated content to this library, such as Server-Side-Request-Forgery, file disclosure or potentially executing code on the system. The risk depends on your system configuration and the installed library version. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. These versions do not use this library anymore. As a workaround users may disable previews by setting `enable_previews` to `false` in `config.php`.

Patch / fix

fixed in 1 distros 1

nextcloud nextcloud_server 20.0.12, 21.0.4, 22.1.0

nextcloud Package Hub 15 SP2 20.0.12-bp152.2.12.1
nextcloud Package Hub 15 SP3, openSUSE Leap 15.3 20.0.12-bp153.2.6.1
nextcloud openSUSE Leap 15.2 20.0.12-lp152.3.12.1
nextcloud Package Hub 12 20.0.12-31.1
nextcloud Package Hub 15 SP1 20.0.12-bp151.3.18.1

opensuse advisories openSUSE-SU-2021:1275-1 openSUSE-SU-2021:1255-1 openSUSE-SU-2021:1253-1 openSUSE-SU-2021:1252-1 openSUSE-SU-2021:1250-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-32802 updated 2025-11-21 cvss 9.8

nextcloud: supplying third party library with untrusted user input may lead to remote code execution

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.60% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

nextcloud security-advisories

Classification

Weakness

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

References

security.gentoo.org /glsa/202208-17
vendor-advisory, third-party-advisory
docs.nextcloud.com /server/21/admin_manual/configuration_files/previews_configuration.html#disabling-previews
vendor-advisory
github.com /nextcloud/security-advisories/security/advisories/GHSA-m682-v4g9-wrq7
mitigation, third-party-advisory
hackerone.com /reports/1261413
permissions-required, third-party-advisory

Sources

CVE List CVE-2021-32802
NVD CVE-2021-32802

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary