CVE-2021-39224

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the OfficeOnline application is upgraded to 1.1.1. As a workaround, one may disable the OfficeOnline application in the app settings.

• CWE-200

• https://github.com/nextcloud/officeonline/pull/204Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-56wm-r6jm-3v9hThird Party Advisory
• https://github.com/nextcloud/officeonline/pull/204Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-56wm-r6jm-3v9hThird Party Advisory

Published

Oct 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39219Wasmtime is an open source runtime for WebAssembly & WASI. W…6.3
• CVE-2021-3922A race condition vulnerability was reported in IMController,…7
• CVE-2021-39220Nextcloud is an open-source, self-hosted productivity platfo…3.5
• CVE-2021-39221Nextcloud is an open-source, self-hosted productivity platfo…5.4
• CVE-2021-39222Nextcloud is an open-source, self-hosted productivity platfo…6.1
• CVE-2021-39223Nextcloud is an open-source, self-hosted productivity platfo…5.3
• CVE-2021-39225Nextcloud is an open-source, self-hosted productivity platfo…8.1
• CVE-2021-39226Grafana is an open source data visualization platform. In af…7.3
• CVE-2021-39227ZRender is a lightweight graphic library providing 2d draw f…9.8
• CVE-2021-39228Tremor is an event processing system for unstructured data. …9.8
• CVE-2021-39229Apprise is an open source library which allows you to send a…7.5
• CVE-2021-3923A flaw was found in the Linux kernel's implementation of RDM…2.3