CVE-2022-31132

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css-tidy/css_optimiser.php`. Access to the minifier is unrestricted and access may lead to Server-Side Request Forgery (SSRF). It is recommendet to upgrade to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at `./vendor/cerdic/css-tidy/css_optimiser.php`

• CWE-918

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24pm-rjfv-23mhThird Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24pm-rjfv-23mhThird Party Advisory

Published

Aug 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31127NextAuth.js is a complete open source authentication solutio…6.1
• CVE-2022-31128Tuleap is a Free & Open Source Suite to improve management o…5.4
• CVE-2022-31129moment is a JavaScript date library for parsing, validating,…7.5
• CVE-2022-3113An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31130Grafana is an open source observability and data visualizati…7.5
• CVE-2022-31131Nextcloud mail is a Mail app for the Nextcloud home server p…4.3
• CVE-2022-31133HumHub is an Open Source Enterprise Social Network. Affected…4.8
• CVE-2022-31134Zulip is an open-source team collaboration tool. Zulip Serve…4.9
• CVE-2022-31135Akashi is an open source server implementation of the Attorn…7.5
• CVE-2022-31136Bookwyrm is an open source social reading and reviewing prog…6.1
• CVE-2022-31137Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.8
• CVE-2022-31138mailcow is a mailserver suite. Prior to mailcow-dockerized v…8.8