Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

Nextcloud at risk from unsafe HTTP message library

published 4 days ago
Summary

The Nextcloud installation relies on the guzzlehttp/psr7 PHP library, which has a security flaw that could be triggered by specially crafted web requests. An attacker could exploit this to cause errors or potentially run unwanted code on the server. Update Nextcloud to the latest release or replace the guzzlehttp/psr7 component with a patched version as soon as possible.

What to do
  • Update cleanstart nextcloud to version 32.0.3-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart nextcloud < 32.0.3-r0
Fix: upgrade to 32.0.3-r0
Original advisory text
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP
Security vulnerability affects the nextcloud package. guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.8 Medium
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-LY70913 · OSV
Track software like this
Free during beta