Vulnerability in Nextcloud Collectives

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

[ Fixes ]Fixes and patches

• Security bulletin: Nextcloud GHSA-f99w-3pm7-v4cvVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-f99w, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-4vpp-fp9q-9g23Vendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-4vpp, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-5gv7-hw69-w6pxVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-5gv7, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-9mjh-89xm-hcqwVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-9mjh, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-22w9-gpgv-pcgcVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-22w9, cited by CERT-FR CERTFR-2026-AVI-1283

[ Advisories ]Government CERT advisories

• CERT-FR9 Oct 2026CERTFR-2026-AVI-1283

  Multiple vulnerabilities in Nextcloud products Translated from French

  Multiple vulnerabilities have been discovered in Nextcloud products. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

  CVE-2026-82985CVE-2026-68493CVE-2026-77169+2 more CVEs
• BSI CERT-Bund8 Oct 2026WID-SEC-2026-3840

  Nextcloud: Multiple vulnerabilities Translated from German

  CVE-2026-77166CVE-2026-77169CVE-2026-68493+2 more CVEs

[ References ]References

• hackerone.com/reports/3599470