Lukasreschkenc

Nextcloud server is an open source, self-hosted personal cloud that supports rendering image previews for user-provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. This poses several security concerns, such as Server-Side-Request-Forgery, file disclosure, or potentially executing code on the system. The risk depends on the system configuration and the installed library version.

The issue affects Nextcloud Server, a package that handles data storage. In the affected versions, ratelimits are not applied to OCS API responses, which can be exploited by affecting any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. The risk depends on the installed applications on the Nextcloud Server and could range from bypassing authentication ratelimits to spamming other Nextcloud users.

A cross-site scripting issue is present in the Nextcloud Text application. The application uses a `text/html` Content-Type when serving files to users. However, due to the strict Content-Security-Policy, this issue is not exploitable on modern browsers that support Content-Security-Policy.

The Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user, which could result in a full path disclosure on shared files.