CVE-2026-45722

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45722
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45722.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45722
Aliases
  • GHSA-5h2w-c7px-hp4j
Published
2026-06-01T17:11:15.481Z
Modified
2026-07-15T01:49:14.524725665Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CVSS Calculator
Summary
Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
Details

Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER BY statement of a query. Compared to normal SQL injections, the ORDER BY is limited to extracting a single bit of information per request or to make the database wait for a given time. This issue has been patched in versions 0.9.7 and 1.0.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45722.json"
}
References

Affected packages

Git / github.com/nextcloud/tables

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/tables
Events
Introduced
903a2312c8885cfe83fe71db18f7c3de47a3dee8
Fixed
24b3ca930d9bab79934ffd0a693a17cbdbe3aaa5
Introduced
9eb949efd533fae206da032916baf0a02cc7ddba
Fixed
942f7db2eb3c1c983dde379f81b0b1cbb098c228
Database specific 
{
    "cpe": "cpe:2.3:a:nextcloud:tables:*:*:*:*:*:nextcloud:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0.9.0"
        },
        {
            "fixed": "0.9.7"
        },
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.0.2"
        }
    ]
}

Affected versions

v0.*
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v1.*
v1.0.0
v1.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45722.json"