CVE-2021-41178 File Traversal affecting SVG files on Nextcloud Server
Attackers can download arbitrary SVG files from the host system, potentially enabling phishing attacks via malicious SVGs, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41178?
CVE-2021-41178 is a high-severity path traversal vulnerability in nextcloud security-advisories, published on 25 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishing attack, an attacker could upload a malicious SVG file that mimics the Nextcloud login form and send a specially crafted link to victims. The XSS risk here is mitigated due to the fact that Nextcloud employs a strict Content-Security-Policy disallowing execution of arbitrary JavaScript. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.
Which versions are affected by CVE-2021-41178?
It affects 1 product.
Products include Nextcloud Server.
How do I fix CVE-2021-41178?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-41178 being exploited?
There is no known exploitation of CVE-2021-41178 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
Sources
Also known as GHSA-jp9c-vpr3-m5rf.