Nextcloud · Report #2247457
Can download files by zipping the folder
Validstatus
mediumseverity
41upvotes
17 Feb 2024disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq
How it was found
- Create folder and share it as view-only
{F2846936}
- Access this folder with Testuser
{F2846943}
- Go one level up and compress the whole folder
{F2846942}
- The zip file can be downloaded and extracted locally
{F2846939} {F2846941}
- The folder itself can not be downloaded directly
{F2846937}
Impact
Can download files without download permissions