CVE-2021-22895

MEDIUM 5.9CVE-2021-22895 · Published 11/06/2021 · updated 17/06/2026

In short

CVE-2021-22895 is a MEDIUM (CVSS 5.9) vulnerability affecting desktop (nextcloud).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.9% of all vulnerabilities.
Fix: update to 3.1.3 or later.

Package	Affected versions	Patched versions
desktop nextcloud	`< 3.1.3`	`3.1.3`

Description

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.

References

nextcloud/desktop#2926 · Patch
nextcloud/desktop release v3.1.3 · Release Notes
nextcloud/security-advisories security advisory · Third Party Advisory
hackerone.com/reports/903424 · Exploit
debian.org/security/2021/dsa-4974 · Third Party Advisory

More vulnerabilities in desktop

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

desktop

nextcloud

< 3.1.3

3.1.3

More vulnerabilities in desktop

See all →