Nextcloud · Report #1965156
Text does not respect 'Allow download' permissions
Validstatus
lowseverity
$250bounty
12upvotes
23 Aug 2023disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qhgm-w4gx-gvgp
How it was found
- user0 shares a folder of sensitive images to user1 without the 'Allow download' permission
- user1 just creates a new text file and inserts the images into it
- Voilla the images appear and can be downloaded easily
These are just previews but still. For the most common types you can even request the raw image https://github.com/nextcloud/text/blob/main/lib/Controller/AttachmentController.php#L57-L67
Impact
A user assume that the allow download feature works can still have their sensitive photos leaked.