CVE-2023-35171

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known workarounds are available.

• CWE-601
• CWE-601

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h353-vvwv-j2r4Exploit, Issue Tracking, Vendor Advisory
• https://github.com/nextcloud/server/pull/38194Issue Tracking, Patch
• https://hackerone.com/reports/1977222Exploit, Issue Tracking, Mitigation, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h353-vvwv-j2r4Exploit, Issue Tracking, Vendor Advisory
• https://github.com/nextcloud/server/pull/38194Issue Tracking, Patch
• https://hackerone.com/reports/1977222Exploit, Issue Tracking, Mitigation, Third Party Advisory

Published

Jun 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35166XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-35167Remult is a CRUD framework for full-stack TypeScript. If you…6.3
• CVE-2023-35168DataEase is an open source data visualization analysis tool …6.5
• CVE-2023-35169PHP-IMAP is a wrapper for common IMAP communication without …9.8
• CVE-2023-3517 Hitachi Vantara Pentaho Data Integration & Analytics versio…8.8
• CVE-2023-35170Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2023-35172NextCloud Server and NextCloud Enterprise Server provide fil…9.1
• CVE-2023-35173Nextcloud End-to-end encryption app provides all the necessa…6.5
• CVE-2023-35174Livebook is a web application for writing interactive and co…9.8
• CVE-2023-35175Certain HP LaserJet Pro print products are potentially vulne…9.8
• CVE-2023-35176Certain HP LaserJet Pro print products are potentially vulne…8.8
• CVE-2023-35177Certain HP LaserJet Pro print products are potentially vulne…8.8