Nextcloud · Report #1745766
Disabled download shares still allow download through preview images
Validstatus
lowseverity
18upvotes
31 Dec 2022disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9mh6-cph8-772c
How it was found
Summary:
Steps To Reproduce:
- Share a folder and disable the "Allow download" permission
- Now as the recipient of the file you can still download the preview of the file
This is an issue for images but also for shared documents where viewing them in Collabora would present them watermarked but the preview would leak the first page without an watermark.
Impact
Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked.