Nextcloud · Report #2326618
Deck app allows to spoof file extensions by using RTLO characters
Validstatus
mediumseverity
$100bounty
19upvotes
4 Jan 2026disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xjvq-xvr7-xpg6
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.