# CVE-2022-41882: nextcloud-desktop: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer

CVE-2022-41882 is fixed in nextcloud-desktop on 1 platform, first by DEBIAN-CVE-2022-41882, released November 11, 2022. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-41882
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0049
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 11, 2022

## Description

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In version 3.6.0, if a user received a malicious file share and has it synced locally or the virtual filesystem enabled and clicked a nc://open/ link it will open the default editor for the file type of the shared file, which on Windows can also sometimes mean that a file depending on the type, e.g. "vbs", is being executed. It is recommended that the Nextcloud Desktop client is upgraded to version 3.6.1. As a workaround, users can block the Nextcloud Desktop client 3.6.0 by setting the `minimum.supported.desktop.version` system config to `3.6.1` on the server, so new files designed to use this attack vector are not downloaded anymore. Already existing files can still be used. Another workaround would be to enforce shares to be accepted by setting the `sharing.force_share_accept` system config to `true` on the server, so new files designed to use this attack vector are not downloaded anymore. Already existing shares can still be abused.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | nextcloud-desktop Debian 12.15 (bookworm) | 3.6.1-1 | [DEBIAN-CVE-2022-41882](https://patchblox.com/security/data/fix/linux/debian-cve-2022-41882.md) | Nov 11, 2022 |
| Linux | nextcloud-desktop Debian 13.5 (trixie) | 3.6.1-1 | [DEBIAN-CVE-2022-41882](https://patchblox.com/security/data/fix/linux/debian-cve-2022-41882.md) | Nov 11, 2022 |
| Linux | nextcloud-desktop Debian 14 | 3.6.1-1 | [DEBIAN-CVE-2022-41882](https://patchblox.com/security/data/fix/linux/debian-cve-2022-41882.md) | Nov 11, 2022 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.