CVE-2024-22404

MOYENNE 4.3CVE-2024-22404 · Published 18/01/2024 · updated 17/06/2026

En bref

CVE-2024-22404 est une vulnérabilité MOYENNE (CVSS 4.3) touchant zipper (nextcloud).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.52%, plus élevée que 44.0% des vulnérabilités.
Correctif : mettre à jour vers 1.2.1 ou plus récent.

Package	Affected versions	Patched versions
zipper nextcloud	`= 1.4.0< 1.2.1`	`1.2.1`

Description

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.

References

nextcloud/files_zip commit 4320453 · Patch
nextcloud/security-advisories security advisory · Vendor Advisory
hackerone.com/reports/2247457 · Permissions Required

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free