# \#security **URL:** https://help.nextcloud.com/tag/security/24.md [Latest](https://help.nextcloud.com/latest.md) · [Categories](https://help.nextcloud.com/categories.md) · [Tags](https://help.nextcloud.com/tags.md) --- ## [Change the config data "secret"](https://help.nextcloud.com/t/change-the-config-data-secret/249808)
**Author:** [@ahlund](https://help.nextcloud.com/u/ahlund)\ **Replies:** 9\ **Last updated:** [November 10, 2026, 5:13pm UTC](https://help.nextcloud.com/t/change-the-config-data-secret/249808 "2026-11-10T17:13:30Z")
▶ Support intro Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can. :heart: The Basics Nextcloud Server version (e.g., 29.x.x): 34.0.4 O… --- ## [To Collabora Built-in User: Update ASAP](https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516)
**Author:** [@mritzmann](https://help.nextcloud.com/u/mritzmann)\ **Replies:** 9\ **Last updated:** [October 26, 2026, 1:48pm UTC](https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 "2026-10-26T13:48:09Z")
Just as a note, since AFAIK no warning or CVE has been published: If anyone is running a Nextcloud with the “Collabora Online - Built-in CODE Server”-app installed, you should update to the newest App version as soon as… --- ## [New PHP vulnerability CVE-2026-115560 in community docker image](https://help.nextcloud.com/t/new-php-vulnerability-cve-2026-115560-in-community-docker-image/251425)
**Author:** [@Dominik2](https://help.nextcloud.com/u/Dominik2)\ **Replies:** 8\ **Last updated:** [October 26, 2026, 10:17am UTC](https://help.nextcloud.com/t/new-php-vulnerability-cve-2026-115560-in-community-docker-image/251425 "2026-10-26T10:17:29Z")
Hello, has anyone seen the new PHP (not php2shell) vulnerability CVE-2026-115560: I checked the .ini files in /usr/local/etc/php/conf.d in the nextcloud community image and it looks like session.serialize\_handler is … --- ## [Is Nextcloud 33.0.10 Docker affected by CVE-2026-111497 (Brotli)?](https://help.nextcloud.com/t/is-nextcloud-33-0-10-docker-affected-by-cve-2026-111497-brotli/251517)
**Author:** [@sswayd](https://help.nextcloud.com/u/sswayd)\ **Replies:** 2\ **Last updated:** [October 25, 2026, 7:00pm UTC](https://help.nextcloud.com/t/is-nextcloud-33-0-10-docker-affected-by-cve-2026-111497-brotli/251517 "2026-10-25T19:00:20Z")
Hello, I would like to confirm whether the official Nextcloud Docker image is affected by CVE-2026-111497 related to Google Brotli. Environment: Nextcloud Server: 33.0.10 Docker image: nextcloud:33.0.10-apache … --- ## [Is nextcloud susceptible to the PHP2shell attack?](https://help.nextcloud.com/t/is-nextcloud-susceptible-to-the-php2shell-attack/251255)
**Author:** [@gjpc](https://help.nextcloud.com/u/gjpc)\ **Replies:** 50\ **Last updated:** [October 25, 2026, 5:45pm UTC](https://help.nextcloud.com/t/is-nextcloud-susceptible-to-the-php2shell-attack/251255 "2026-10-25T17:45:19Z")
I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.) on Which general topic do you have The PHP2shell attacks are starting. Is nextcloud su… --- ## [Keep an eye on critical PHP vulnerability](https://help.nextcloud.com/t/keep-an-eye-on-critical-php-vulnerability/251258)
**Author:** [@JoMatr](https://help.nextcloud.com/u/JoMatr)\ **Replies:** 1\ **Last updated:** [October 21, 2026, 7:06am UTC](https://help.nextcloud.com/t/keep-an-eye-on-critical-php-vulnerability/251258 "2026-10-21T07:06:47Z")
I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.) on Which general topic do you have --- ## [PHP vulnerability issue](https://help.nextcloud.com/t/php-vulnerability-issue/251257)
**Author:** [@RdedR](https://help.nextcloud.com/u/RdedR)\ **Replies:** 1\ **Last updated:** [October 21, 2026, 7:06am UTC](https://help.nextcloud.com/t/php-vulnerability-issue/251257 "2026-10-21T07:06:16Z")
I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.) on Which general topic do you have Please note: CVE-2026-109618 and CVE-2026-109619 (sco… --- ## [Publicly disclosed Nextcloud 0-days – are fixed versions available?](https://help.nextcloud.com/t/publicly-disclosed-nextcloud-0-days-are-fixed-versions-available/250650)
**Author:** [@Akiyoshi\_Kurita](https://help.nextcloud.com/u/Akiyoshi_Kurita)\ **Replies:** 1\ **Last updated:** [October 19, 2026, 9:11am UTC](https://help.nextcloud.com/t/publicly-disclosed-nextcloud-0-days-are-fixed-versions-available/250650 "2026-10-19T09:11:05Z")
I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.) on Which general topic do you have Publicly disclosed Nextcloud 0-days – are fixed versi… --- ## [occ-Missbrauch durch "richdocumentscode" 26.4.302?](https://help.nextcloud.com/t/occ-missbrauch-durch-richdocumentscode-26-4-302/249826)
**Author:** [@wurzelmuepf](https://help.nextcloud.com/u/wurzelmuepf)\ **Replies:** 2\ **Last updated:** [September 23, 2026, 4:55pm UTC](https://help.nextcloud.com/t/occ-missbrauch-durch-richdocumentscode-26-4-302/249826 "2026-09-23T16:55:00Z")
Moin, ich hab hier ein paar beunruhigende Nachrichten gefunden: 33.0.8.2: Rating A - not on latest patch level ! Ich hatte das Update auf 33.0.9 wg. Unklarheiten mit der/den php-Version(en) vorerst zurückgestellt. 14… --- ## [NC nur noch lokal](https://help.nextcloud.com/t/nc-nur-noch-lokal/249606)
**Author:** [@civil](https://help.nextcloud.com/u/civil)\ **Replies:** 8\ **Last updated:** [September 18, 2026, 2:14pm UTC](https://help.nextcloud.com/t/nc-nur-noch-lokal/249606 "2026-09-18T14:14:25Z")
Ich möchte meineMfg zuhause auf einem kleinen Ubuntu Server laufende Nextcloud nur noch lokal laufen lassen um mich soweit wie möglich zu schützen. Router ist eine Fritzbox 7490. Reicht es da in der Konfiguration der Ne… --- ## [Nextcloud Sicherheit - Schadsoftware, AntiVirus, Benutzer einschränken](https://help.nextcloud.com/t/nextcloud-sicherheit-schadsoftware-antivirus-benutzer-einschranken/245509)
**Author:** [@spooner](https://help.nextcloud.com/u/spooner)\ **Replies:** 6\ **Last updated:** [June 6, 2026, 8:04pm UTC](https://help.nextcloud.com/t/nextcloud-sicherheit-schadsoftware-antivirus-benutzer-einschranken/245509 "2026-06-06T20:04:05Z")
Hallo Zusammen, ich bin gerade bei der Planung für eine neue Nextcloud einzurichten und dabei kam ein Gedanke, denn ich aus der MS365 Welt kenne. Microsoft verhindert, dass man Schadsoftware in Teams oder SharePoint ho… --- ## [CSP "Content Security Policy" missing in Nextcloud manual](https://help.nextcloud.com/t/csp-content-security-policy-missing-in-nextcloud-manual/207822)
**Author:** [@carloscomputer](https://help.nextcloud.com/u/carloscomputer)\ **Replies:** 6\ **Last updated:** [May 31, 2026, 7:22am UTC](https://help.nextcloud.com/t/csp-content-security-policy-missing-in-nextcloud-manual/207822 "2026-05-31T07:22:31Z")
Warning: this is a security related topic. Please read the complete discussion before blindly copying configuration settings. CSP missing in Nextcloud Nginx docs configuration manual: https://docs.nextcloud.com/server/… --- ## [Next lack of security (named “Dirty Frag”) under Linux](https://help.nextcloud.com/t/next-lack-of-security-named-dirty-frag-under-linux/244262)
**Author:** [@Mornsgrans](https://help.nextcloud.com/u/Mornsgrans)\ **Replies:** 1\ **Last updated:** [May 9, 2026, 8:51am UTC](https://help.nextcloud.com/t/next-lack-of-security-named-dirty-frag-under-linux/244262 "2026-05-09T08:51:09Z")
I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.) on Which general topic do you have The next lack of security (named “Dirty Frag”) under … --- ## [Critical apache CVE-2026-23918 - AIO impacted?](https://help.nextcloud.com/t/critical-apache-cve-2026-23918-aio-impacted/244139)
**Author:** [@ChaosMamba](https://help.nextcloud.com/u/ChaosMamba)\ **Replies:** 13\ **Last updated:** [May 7, 2026, 4:13pm UTC](https://help.nextcloud.com/t/critical-apache-cve-2026-23918-aio-impacted/244139 "2026-05-07T16:13:06Z")
I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.) on Which general topic do you have Hi everyone, I came across a recent security advisor… --- ## [Linux Kernel Vulnerability “Copy Fail” (CVE-2026-31431) — Immediate Action Required](https://help.nextcloud.com/t/linux-kernel-vulnerability-copy-fail-cve-2026-31431-immediate-action-required/243987)
**Author:** [@ernolf](https://help.nextcloud.com/u/ernolf)\ **Replies:** 12\ **Last updated:** [May 7, 2026, 6:15am UTC](https://help.nextcloud.com/t/linux-kernel-vulnerability-copy-fail-cve-2026-31431-immediate-action-required/243987 "2026-05-07T06:15:33Z")
:police\_car\_light: URGENT: Kernel Vulnerability “Copy Fail” (CVE-2026-31431) — Immediate Action Required A critical Linux kernel vulnerability known as “Copy Fail” (CVE-2026-31431) is currently being actively discussed a… --- ## [Moving application source outside of public html directory](https://help.nextcloud.com/t/moving-application-source-outside-of-public-html-directory/243749)
**Author:** [@lode](https://help.nextcloud.com/u/lode)\ **Replies:** 1\ **Last updated:** [April 26, 2026, 8:24pm UTC](https://help.nextcloud.com/t/moving-application-source-outside-of-public-html-directory/243749 "2026-04-26T20:24:43Z")
The Basics Nextcloud Server version (e.g., 29.x.x): 33.0.2 Operating system and version (e.g., Ubuntu 24.04): replace me Web server and version (e.g, Apache 2.4.25): Apache 2.4.58 Reverse proxy and version \_(e.… --- ## [Logon attempt succesfull or not?](https://help.nextcloud.com/t/logon-attempt-succesfull-or-not/233845)
**Author:** [@theking2](https://help.nextcloud.com/u/theking2)\ **Replies:** 3\ **Last updated:** [March 11, 2026, 1:26am UTC](https://help.nextcloud.com/t/logon-attempt-succesfull-or-not/233845 "2026-03-11T01:26:09Z")
I see a logon attempt in the desktop client but it does not say if it was successfull or not. Is there a way to find this out? --- ## [Some requests go to "nextcloudpi", which is the internal host name of my Raspberry Pi](https://help.nextcloud.com/t/some-requests-go-to-nextcloudpi-which-is-the-internal-host-name-of-my-raspberry-pi/239072)
**Author:** [@Diederick](https://help.nextcloud.com/u/Diederick)\ **Replies:** 7\ **Last updated:** [January 24, 2026, 7:07am UTC](https://help.nextcloud.com/t/some-requests-go-to-nextcloudpi-which-is-the-internal-host-name-of-my-raspberry-pi/239072 "2026-01-24T07:07:27Z")
Nextcloud Server version: Nextcloud Hub 25 Autumn (32.0.1) Operating system and version (e.g., Ubuntu 24.04): Linux nextcloudpi 6.12.41-current-bcm2711 Web server and version (e.g, Apache 2.4.25): Apache 2.… --- ## [In control of your data (Privacy and Security) - Admin should see all Company data](https://help.nextcloud.com/t/in-control-of-your-data-privacy-and-security-admin-should-see-all-company-data/239033)
**Author:** [@BeHappyYou](https://help.nextcloud.com/u/BeHappyYou)\ **Replies:** 8\ **Last updated:** [January 21, 2026, 4:50pm UTC](https://help.nextcloud.com/t/in-control-of-your-data-privacy-and-security-admin-should-see-all-company-data/239033 "2026-01-21T16:50:10Z")
I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.) on Which general topic do you have I have seen that there were several questions about t… --- ## [HMAC does not match. .wellknown URLs fail2ban not helping](https://help.nextcloud.com/t/hmac-does-not-match-wellknown-urls-fail2ban-not-helping/238034)
**Author:** [@Richard\_Horan](https://help.nextcloud.com/u/Richard_Horan)\ **Replies:** 4\ **Last updated:** [January 2, 2026, 9:29am UTC](https://help.nextcloud.com/t/hmac-does-not-match-wellknown-urls-fail2ban-not-helping/238034 "2026-01-02T09:29:42Z")
▶ Support intro Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can. :heart: The Basics Nextcloud Server version (e.g., 29.x.x): 32.0.3 O… --- ## [Collabora external and internal not reachable](https://help.nextcloud.com/t/collabora-external-and-internal-not-reachable/237344)
**Author:** [@roelofz](https://help.nextcloud.com/u/roelofz)\ **Replies:** 6\ **Last updated:** [December 24, 2025, 9:49am UTC](https://help.nextcloud.com/t/collabora-external-and-internal-not-reachable/237344 "2025-12-24T09:49:47Z")
Hi, After the upgrade to 25 Autumn I am having trouble with Collabora. I ran it as an external container (posted earlier about how I solved this before, because by default AIO blocks this, disabling NEXTCLOUD\_KEEP\_DISA… --- ## [Outdated OpenSSL Version on nextcloud desktop (windows)](https://help.nextcloud.com/t/outdated-openssl-version-on-nextcloud-desktop-windows/237663)
**Author:** [@benken](https://help.nextcloud.com/u/benken)\ **Replies:** 6\ **Last updated:** [December 23, 2025, 3:27pm UTC](https://help.nextcloud.com/t/outdated-openssl-version-on-nextcloud-desktop-windows/237663 "2025-12-23T15:27:53Z")
It looks like nextcloud desktop 4.0.4 (latest version) is still coming with an outdated OpenSSL (libcrypto-3-x64.dll) on Windows, which is vulnerable to a known CVE. Our Vulnerability scanner actually is altering on this… --- ## [Outdated npm components of app skeleton generator](https://help.nextcloud.com/t/outdated-npm-components-of-app-skeleton-generator/236773)
**Author:** [@deakus](https://help.nextcloud.com/u/deakus)\ **Replies:** 4\ **Last updated:** [December 5, 2025, 6:28pm UTC](https://help.nextcloud.com/t/outdated-npm-components-of-app-skeleton-generator/236773 "2025-12-05T18:28:17Z")
Hi I’m using the output of the skeleton app.tar.gz so i can iterate and learn how to construct a nextcloud application, the back end and front end. I understand that there is a transition to Vite from webpack, and al… --- ## [Am I worrying more than I should about exposing ports 80 and 443 in order to make my NextCloud account accessible online?](https://help.nextcloud.com/t/am-i-worrying-more-than-i-should-about-exposing-ports-80-and-443-in-order-to-make-my-nextcloud-account-accessible-online/233483)
**Author:** [@hap](https://help.nextcloud.com/u/hap)\ **Replies:** 6\ **Last updated:** [November 8, 2025, 10:51am UTC](https://help.nextcloud.com/t/am-i-worrying-more-than-i-should-about-exposing-ports-80-and-443-in-order-to-make-my-nextcloud-account-accessible-online/233483 "2025-11-08T10:51:53Z")
I have installed NextCloud AIO (version 31.0.9.1) on a laptop at home that’s running Linux Mint. I set up 2FA for all users except a guest account (which I plan to delete), and also updated the built-in brute force prote… --- ## [Can Access composer.json and package.json Anonymously](https://help.nextcloud.com/t/can-access-composer-json-and-package-json-anonymously/234585)
**Author:** [@gerowen](https://help.nextcloud.com/u/gerowen)\ **Replies:** 5\ **Last updated:** [November 6, 2025, 9:05pm UTC](https://help.nextcloud.com/t/can-access-composer-json-and-package-json-anonymously/234585 "2025-11-06T21:05:04Z")
So I’m tinkering around my server, just out of curiosity and decided to scan myself with dirb where I discovered I can access composer.json and package.json anonymously, and from an external IP, by just adding /composer … --- ## [Webdav access bypassing OpenID Connect user backend](https://help.nextcloud.com/t/webdav-access-bypassing-openid-connect-user-backend/234531)
**Author:** [@ahlund](https://help.nextcloud.com/u/ahlund)\ **Replies:** 8\ **Last updated:** [October 29, 2025, 6:37pm UTC](https://help.nextcloud.com/t/webdav-access-bypassing-openid-connect-user-backend/234531 "2025-10-29T18:37:52Z")
▶ Support intro Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can. :heart: The Basics Nextcloud Server version (e.g., 29.x.x): 31.0.9 O… --- ## [Feature request: make registered devices esier to identify](https://help.nextcloud.com/t/feature-request-make-registered-devices-esier-to-identify/233901)
**Author:** [@weka](https://help.nextcloud.com/u/weka)\ **Replies:** 3\ **Last updated:** [October 12, 2025, 4:33pm UTC](https://help.nextcloud.com/t/feature-request-make-registered-devices-esier-to-identify/233901 "2025-10-12T16:33:53Z")
I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.) on Which general topic do you have Hello, I noticed that when you register several remo… --- ## [Next cloud Security](https://help.nextcloud.com/t/next-cloud-security/232456)
**Author:** [@JamesCRocks](https://help.nextcloud.com/u/JamesCRocks)\ **Replies:** 12\ **Last updated:** [September 27, 2025, 3:26pm UTC](https://help.nextcloud.com/t/next-cloud-security/232456 "2025-09-27T15:26:39Z")
▶ Hi, I’m considering ways to make my nextcloud installation available to my devices outside of my home… what can I do to protect my data and network against bots and other bad actors? Thanks James --- ## [Solved: Nextcloud unable to load CSS, login page shows '{productName}'](https://help.nextcloud.com/t/solved-nextcloud-unable-to-load-css-login-page-shows-productname/232050)
**Author:** [@frankt](https://help.nextcloud.com/u/frankt)\ **Replies:** 2\ **Last updated:** [September 14, 2025, 8:15pm UTC](https://help.nextcloud.com/t/solved-nextcloud-unable-to-load-css-login-page-shows-productname/232050 "2025-09-14T20:15:05Z")
▶ Support intro The Basics Nextcloud Server version (e.g., 29.x.x): Nextcloud Hub 10 (31.0.9) Operating system and version (e.g., Ubuntu 24.04): AlmaLinux 8.10 Web server and version (e.g, Apache 2.4.25): 2.… --- ## [How to manage security brute force protection and throttling in Nextcloud snap](https://help.nextcloud.com/t/how-to-manage-security-brute-force-protection-and-throttling-in-nextcloud-snap/231228)
**Author:** [@scubamuc](https://help.nextcloud.com/u/scubamuc)\ **Replies:** 0\ **Last updated:** [August 30, 2025, 10:16am UTC](https://help.nextcloud.com/t/how-to-manage-security-brute-force-protection-and-throttling-in-nextcloud-snap/231228 "2025-08-30T10:16:26Z")
Managing security brute force protection and throttling in Nextcloud snap Nextcloud has built-in protection against brute force attempts. The brute force protection feature is meant to protect Nextcloud servers from … [Next page](https://help.nextcloud.com/tag/security/24.md?match_all_tags=true&page=1&tags%5B%5D=security)