Low severity3.5NVD Advisory· Published Oct 25, 2021· Updated Jun 17, 2026
CVE-2021-39224
CVE-2021-39224
Description
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file shared.txt is located within /files/$username/Myfolder/Mysubfolder/shared.txt). It is recommended that the OfficeOnline application is upgraded to 1.1.1. As a workaround, one may disable the OfficeOnline application in the app settings.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:nextcloud:officeonline:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:nextcloud:officeonline:*:*:*:*:*:*:*:*range: <1.1.1
- (no CPE)range: <1.1.1
- nextcloud/security-advisoriesv5Range: < 1.1.1
Patches
Vulnerability mechanics
References
2- github.com/nextcloud/officeonline/pull/204nvdPatchThird Party Advisory
- github.com/nextcloud/security-advisories/security/advisories/GHSA-56wm-r6jm-3v9hnvdThird Party Advisory
News mentions
0No linked articles in our index yet.