CVE-2024-22404

MEDIO 4.3CVE-2024-22404 · Published 18/01/2024 · updated 17/06/2026

En resumen

CVE-2024-22404 es una vulnerabilidad MEDIO (CVSS 4.3) que afecta a zipper (nextcloud).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.52%, mayor que el 44.0% de las vulnerabilidades.
Solución: actualizar a 1.2.1 o posterior.

Package	Affected versions	Patched versions
zipper nextcloud	`= 1.4.0< 1.2.1`	`1.2.1`

Description

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.

References

nextcloud/files_zip commit 4320453 · Patch
nextcloud/security-advisories security advisory · Vendor Advisory
hackerone.com/reports/2247457 · Permissions Required

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free