Medium severity5.4OSV Advisory· Published Sep 17, 2016· Updated Jun 17, 2026

CVE-2016-7419

Description

Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nextcloud/GalleryOSV
Range: 2.0.0, 2.0.10, 2.0.6, …
Nextcloud/Server
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Range: <=9.0.51
OwnCloud/Owncloud2 versions
cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*range: <=9.0.3
- (no CPE)range: <9.0.4
Nextcloud/Nextcloud Enterprise Serverllm-fuzzy
Range: <9.0.52

Patches

Vulnerability mechanics

References

github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fcnvdPatch
hackerone.com/reports/145355nvdExploitMailing ListThird Party Advisory
nextcloud.com/security/advisory/nvdVendor Advisory
owncloud.org/security/advisory/nvdVendor Advisory
www.securityfocus.com/bid/92373nvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000