CVE-2021-43863

The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFileProvider` have security issues (an SQL injection, and an insufficient permission control, respectively) that allow malicious apps in the same device to access Nextcloud's data bypassing the permission control system. Users should upgrade to version 3.18.1 to receive a patch. There are no known workarounds aside from upgrading.

• CWE-89
• CWE-89

• https://github.com/nextcloud/android/commit/627caba60e69e223b0fc89c4cb18eaa76a95db95Patch, Third Party Advisory
• https://github.com/nextcloud/android/security/advisories/GHSA-vjp2-f63v-w479Third Party Advisory
• https://hackerone.com/reports/1358597Permissions Required
• https://github.com/nextcloud/android/commit/627caba60e69e223b0fc89c4cb18eaa76a95db95Patch, Third Party Advisory
• https://github.com/nextcloud/android/security/advisories/GHSA-vjp2-f63v-w479Third Party Advisory
• https://hackerone.com/reports/1358597Permissions Required

Published

Jan 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43858MinIO is a Kubernetes native application for cloud storage. …8.8
• CVE-2021-43859XStream is an open source java library to serialize objects …7.5
• CVE-2021-4386The WP Security Question plugin for WordPress is vulnerable …4.3
• CVE-2021-43860Flatpak is a Linux application sandboxing and distribution f…8.6
• CVE-2021-43861Mermaid is a Javascript based diagramming and charting tool …5.4
• CVE-2021-43862jQuery Terminal Emulator is a plugin for creating command li…5.4
• CVE-2021-43864Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43865Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43866Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43867Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43868Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43869Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…