CVE-2021-32802

Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several security concerns with passing user-generated content to this library, such as Server-Side-Request-Forgery, file disclosure or potentially executing code on the system. The risk depends on your system configuration and the installed library version. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. These versions do not use this library anymore. As a workaround users may disable previews by setting `enable_previews` to `false` in `config.php`.

• CWE-829
• CWE-829

• https://docs.nextcloud.com/server/21/admin_manual/configuration_files/previews_configuration.html#disabling-previewsVendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m682-v4g9-wrq7Mitigation, Third Party Advisory
• https://hackerone.com/reports/1261413Permissions Required, Third Party Advisory
• https://security.gentoo.org/glsa/202208-17Third Party Advisory
• https://docs.nextcloud.com/server/21/admin_manual/configuration_files/previews_configuration.html#disabling-previewsVendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m682-v4g9-wrq7Mitigation, Third Party Advisory
• https://hackerone.com/reports/1261413Permissions Required, Third Party Advisory
• https://security.gentoo.org/glsa/202208-17Third Party Advisory

Published

Sep 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32795ArchiSteamFarm is a C# application with primary purpose of i…5.9
• CVE-2021-32796xmldom is an open source pure JavaScript W3C standard-based …5.3
• CVE-2021-32797JupyterLab is a user interface for Project Jupyter which wil…9.6
• CVE-2021-32798The Jupyter notebook is a web-based notebook environment for…9.6
• CVE-2021-32800Nextcloud server is an open source, self hosted personal clo…8.1
• CVE-2021-32801Nextcloud server is an open source, self hosted personal clo…5.5
• CVE-2021-32803The npm package "tar" (aka node-tar) before versions 6.1.2, …8.1
• CVE-2021-32804The npm package "tar" (aka node-tar) before versions 6.1.1, …8.1
• CVE-2021-32805Flask-AppBuilder is an application development framework, bu…6.1
• CVE-2021-32806Products.isurlinportal is a replacement for isURLInPortal me…6.1
• CVE-2021-32807The module `AccessControl` defines security policies for Pyt…7.2
• CVE-2021-32808ckeditor is an open source WYSIWYG HTML editor with rich con…5.4