Vulnerability · Published Jun 1, 2026 · Assigned by GitHub_M

CVE-2026-45545Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution

High 8.2

In plain English

A high-severity SQL injection in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 75.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>= 0.7.0, < 0.7.7>= 0.8.0, < 0.8.10>= 0.9.0, < 0.9.8>= 1.0.0, < 1.0.4

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x43f-gmgh-vvjj x_refsource_CONFIRM
https://github.com/nextcloud/tables/pull/2309 x_refsource_MISC
https://hackerone.com/reports/3462991 x_refsource_MISC