← Vulnerability feed

Vulnerability record · CVE-2021-37617 · published 18 August 2021

CVE-2021-37617: Nextcloud desktop untrusted search path vulnerability

Nextcloud · Desktop

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of previous installations. In versions 3.0.3 through 3.2.4, the Client searches the `Uninstall.exe` file in a folder that can be written by regular users. This could lead to a case where a malicious user creates a malicious `Uninstall.exe`, which would be executed with administrative privileges on the Nextcloud Desktop Client installation. This issue is fixed in Nextcloud Desktop Client version 3.3.0. As a workaround, do not allow untrusted users to create content in the `C:\` system folder and verify that there is no malicious `C:\Uninstall.exe` file on the system.

7.3 CVSS 3.1 High EPSS 0.46% · top 63.0% CWE-426 · Untrusted search pathCWE-427 · Uncontrolled search path element
7.3CVSS 3.1 base score, v2 4.4
0.46%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of previous installations. In versions 3.0.3 through 3.2.4, the Client searches the `Uninstall.exe` file in a folder that can be written by regular users. This could lead to a case where a malicious user creates a malicious `Uninstall.exe`, which would be executed with administrative privileges on the Nextcloud Desktop Client installation. This issue is fixed in Nextcloud Desktop Client version 3.3.0. As a workaround, do not allow untrusted users to create content in the `C:\` system folder and verify that there is no malicious `C:\Uninstall.exe` file on the system.

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/nextcloud/desktop/pull/3497 PatchThird Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q2w-v879-q24v Third Party Advisory
https://hackerone.com/reports/1240749 Permissions RequiredThird Party Advisory
https://github.com/nextcloud/desktop/pull/3497 PatchThird Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q2w-v879-q24v Third Party Advisory
https://hackerone.com/reports/1240749 Permissions RequiredThird Party Advisory

Track CVE-2021-37617 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2024-46958Nextcloud desktop vulnerabilityIn Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world rea…EPSS 0.56%8.8CVE-2023-22472Nextcloud desktop cross-site request forgery vulnerabilityDeck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to m…EPSS 0.20%8.8CVE-2021-22879Nextcloud desktop injection vulnerabilityNextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to exec…EPSS 4.7%7.8CVE-2024-37885Nextcloud desktop code injection vulnerabilityThe Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client fo…EPSS 0.32%7.8CVE-2022-41882Nextcloud desktop code injection vulnerabilityThe Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In version 3.6.0, if a user received a maliciou…EPSS 0.49%7.8CVE-2020-8224Nextcloud desktop code injection vulnerabilityA code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.EPSS 0.66%7.5CVE-2024-52510Nextcloud desktop improper certificate validation vulnerabilityThe Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error b…EPSS 0.74%7.5CVE-2020-8225Nextcloud desktop cleartext storage of sensitive data vulnerabilityA cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication cred…EPSS 0.91%

Source: NIST National Vulnerability Database (record CVE-2021-37617), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.