BIT-nextcloud-2021-43863

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/nextcloud/BIT-nextcloud-2021-43863.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-nextcloud-2021-43863

Aliases

CVE-2021-43863
GHSA-vjp2-f63v-w479

Published

2026-07-12T23:47:45.938Z

Modified

2026-07-13T06:26:19.637856150Z

Summary

SQL Injection in FileContentProvider (GHSL-2021-1007)

Details

The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers FileContentProvider and DiskLruImageCacheFileProvider have security issues (an SQL injection, and an insufficient permission control, respectively) that allow malicious apps in the same device to access Nextcloud's data bypassing the permission control system. Users should upgrade to version 3.18.1 to receive a patch. There are no known workarounds aside from upgrading.

Database specific

{
    "cpes": [
        "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / nextcloud

Package

Name: nextcloud
Purl: pkg:bitnami/nextcloud

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.18.1

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/nextcloud/BIT-nextcloud-2021-43863.json"