CVE-2023-35173

MEDIUM 6.5CVE-2023-35173 · Published 23/06/2023 · updated 17/06/2026

In short

CVE-2023-35173 is a MEDIUM (CVSS 6.5) vulnerability affecting end-to-end encryption (nextcloud).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.3% of all vulnerabilities.
Fix: update to 1.12.4 or later.

Package	Affected versions	Patched versions
end-to-end encryption nextcloud	`≥ 1.12.0, < 1.12.4`	`1.12.4`

Description

Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded to version 1.12.4 that contains the fix.

References

nextcloud/end_to_end_encryption#435 · Patch
nextcloud/security-advisories security advisory · Vendor Advisory
hackerone.com/reports/1914115 · Third Party Advisory

More vulnerabilities in end-to-end encryption

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free