Medium severity4.1NVD Advisory· Published Jan 18, 2024· Updated Jun 17, 2026

CVE-2024-22404

Description

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nextcloud/Zipper2 versions
cpe:2.3:a:nextcloud:zipper:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:nextcloud:zipper:*:*:*:*:*:*:*:*range: <1.2.1
- cpe:2.3:a:nextcloud:zipper:1.4.0:*:*:*:*:*:*:*
Nextcloud/Files Zipllm-fuzzy
Range: 1.2.1, 1.4.1, or 1.5.0
Nextcloud/Nextcloudllm-fuzzy
Range: 1.2.1, 1.4.1, or 1.5.0
Nextcloud/security-advisoriescpe-rescue
Range: >= 1.2.0, < 1.2.1

Patches

Vulnerability mechanics

References

github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820nvdPatch
github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fqnvdVendor Advisory
hackerone.com/reports/2247457nvdPermissions RequiredThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.267
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000