High severity · published Jun 1, 2026
CVE-2026-45545
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
security-advisories · nextcloud
>= 0.7.0, < 0.7.7; >= 0.8.0, < 0.8.10; >= 0.9.0, < 0.9.8; >= 1.0.0, < 1.0.4 · source: vendor
TA
Tables · Nextcloud
0.7.0 before 0.7.7; 0.8.0 before 0.8.10; 0.9.0 before 0.9.8; 1.0.0 before 1.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45545
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45545
Mitigation
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj
Issue Tracking
https://github.com/nextcloud/tables/pull/2309
Permissions Required
https://hackerone.com/reports/3462991
More from security-advisories
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.8
CVE-2026-45284
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
8.1
CVE-2026-45281
Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
8.1
CVE-2026-45156
Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
7.1
CVE-2026-45722
Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views