| Package | Affected versions | Patched versions |
|---|---|---|
| desktop | ≥ 3.0.0, < 3.7.0 | 3.7.0 |
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt files with a key known to the attacker. This issue is fixed in Nextcloud Desktop 3.7.0. No known workarounds are available.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free