CVE-2022-39333

Cross-site scripting (XSS) in Nextcloud Desktop Client

4.6 MediumFix available

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.96%Up 0.1 points since Nov 26, 2022

What each source reports

CVE List Score used 4.6

Cross-site scripting (XSS) in Nextcloud Desktop Client

Record: CVE-2022-39333
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2022-41810 4.6

Record: EUVD-2022-41810
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

NVD 4.6

Record: CVE-2022-39333
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 4.6

Cross-site scripting (XSS) in Nextcloud Desktop Client

Record: CVE-2022-39333
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-39333 6.1

Record: DEBIAN-CVE-2022-39333
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

OSVUBUNTU-CVE-2022-39333 4.6

Record: UBUNTU-CVE-2022-39333
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2023:0090-1 No score

Security update for nextcloud-desktop

This update for nextcloud-desktop fixes the following issues:

nextcloud-desktop was updated to 3.8.0:

Resize WebView widget once the loginpage rendered
Feature/secure file drop
Check German translation for wrong wording
L10n: Correct word
Fix displaying of file details button for local syncfileitem activities
Improve config upgrade warning dialog
Only accept folder setup page if overrideLocalDir is set
Update CHANGELOG.
Prevent ShareModel crash from accessing bad pointers
Bugfix/init value for pointers
Log to stdout when built in Debug config
Clean up account creation and deletion code
L10n: Added dot to end of sentence
L10n: Fixed grammar
Fix 'Create new folder' menu entries in settings not working correctly on macOS
Ci/clang tidy checks init variables
Fix share dialog infinite loading
Fix edit locally job not finding the user account: wrong user id
Skip e2e encrypted files with empty filename in metadata
Use new connect syntax
Fix avatars not showing up in settings dialog account actions until clicked on
Always discover blacklisted folders to avoid data loss when modifying selectivesync list.
Fix infinite loading in the share dialog when public link shares are disabled on the server
With cfapi when dehydrating files add missing flag
Fix text labels in Sync Status component
Display 'Search globally' as the last sharees list element
Fix display of 2FA notification.
Bugfix/do not restore virtual files
Show server name in tray main window
Add Ubuntu Lunar
Debian build classification 'beta' cannot override 'release'.
Update changelog
Follow shouldNotify flag to hide notifications when needed
Bugfix/stop after creating config file
E2EE cut extra zeroes from derypted byte array.
When local sync folder is overriden, respect this choice
Feature/e2ee fixes
This also fix security issues:
- (boo#1205798, CVE-2022-39331)
  - Arbitrary HyperText Markup Language injection in notifications
- (boo#1205799, CVE-2022-39332)
  - Arbitrary HyperText Markup Language injection in user status and information
- (boo#1205800, CVE-2022-39333)
  - Arbitrary HyperText Markup Language injection in desktop client application
- (boo#1205801, CVE-2022-39334)
  - Client incorrectly trusts invalid TLS certificates
- (boo#1207976, CVE-2023-23942)
  - missing sanitisation on qml labels leading to javascript injection
Update to 3.7.4
- check German translation for wrong wording
- Fix 'Create new folder' menu entries in settings not working correctly on macOS
- Clean up account creation and deletion code
- Fix share dialog infinite loading
- fix edit locally job not finding the user account: wrong user id
- skip e2e encrypted files with empty filename in metadata
- Always discover blacklisted folders to avoid data loss when modifying selectivesync list.
- use new connect syntax
- with cfapi when dehydrating files add missing flag
- Fix avatars not showing up in settings dialog account actions until clicked on
- Fix text labels in Sync Status component
- Fix infinite loading in the share dialog when public link shares are disabled on the server
- Ci/clang tidy checks init variables
- Display 'Search globally' as the last sharees list element
- Resize WebView widget once the loginpage rendered
- Bugfix/do not restore virtual files
- Fix display of 2FA notification.
Update to 3.7.3
- Revert 'Fix(l10n): capital_abcd Update translations from Transifex'
- Revert 'Fix(l10n): capital_abcd Update translations from Transifex'
- Revert 'Fix(l10n): capital_abcd Update translations from Transifex'
Update to 3.7.2
- No regular changelog from upstream. See instead: https://github.com/nextcloud/desktop/compare/v3.7.1...v3.7.2
Update to 3.7.1
- Backport/5393/stable 3.7 by @mgallien in #5403
- Fix wrong estimated time when doing sync. in…

Record: openSUSE-SU-2023:0090-1
Updated: 2026-11-02

OSVopenSUSE-SU-2023:0171-1 No score

Security update for nextcloud-desktop

This update for nextcloud-desktop fixes the following issues:

Update ot 3.8.0

Resize WebView widget once the loginpage rendered
Feature/secure file drop
Check German translation for wrong wording
L10n: Correct word
Fix displaying of file details button for local syncfileitem activities
Improve config upgrade warning dialog
Only accept folder setup page if overrideLocalDir is set
Update CHANGELOG.
Prevent ShareModel crash from accessing bad pointers
Bugfix/init value for pointers
Log to stdout when built in Debug config
Clean up account creation and deletion code
L10n: Added dot to end of sentence
L10n: Fixed grammar
Fix 'Create new folder' menu entries in settings not working correctly on macOS
Ci/clang tidy checks init variables
Fix share dialog infinite loading
Fix edit locally job not finding the user account: wrong user id
Skip e2e encrypted files with empty filename in metadata
Use new connect syntax
Fix avatars not showing up in settings dialog account actions until clicked on
Always discover blacklisted folders to avoid data loss when modifying selectivesync list.
Fix infinite loading in the share dialog when public link shares are disabled on the server
With cfapi when dehydrating files add missing flag
Fix text labels in Sync Status component
Display 'Search globally' as the last sharees list element
Fix display of 2FA notification.
Bugfix/do not restore virtual files
Show server name in tray main window
Add Ubuntu Lunar
Debian build classification 'beta' cannot override 'release'.
Update changelog
Follow shouldNotify flag to hide notifications when needed
Bugfix/stop after creating config file
E2EE cut extra zeroes from derypted byte array.
When local sync folder is overriden, respect this choice
Feature/e2ee fixes
This update also fixes security issues:
- (boo#1205798, CVE-2022-39331)
  - Arbitrary HyperText Markup Language injection in notifications
- (boo#1205799, CVE-2022-39332)
  - Arbitrary HyperText Markup Language injection in user status and information
- (boo#1205800, CVE-2022-39333)
  - Arbitrary HyperText Markup Language injection in desktop client application
- (boo#1205801, CVE-2022-39334)
  - Client incorrectly trusts invalid TLS certificates
- (boo#1207976, CVE-2023-23942)
  - missing sanitisation on qml labels leading to javascript injection

Record: openSUSE-SU-2023:0171-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`nextcloud-desktop` Debian:12	before 3.6.1-1	3.6.1-1
`nextcloud-desktop` Debian:13	before 3.6.1-1	3.6.1-1
`nextcloud-desktop` Debian:14	before 3.6.1-1	3.6.1-1
`nextcloud-desktop` Debian:11	before 3.1.1-2+deb11u2, plus listed versions 3.1.1-23.1.1-2+deb11u1	3.1.1-2+deb11u2
`nextcloud-desktop` Ubuntu:20.04:LTS	All versions, plus listed versions 2.5.3-12.6.0-12.6.1-12.6.1-22.6.2-12.6.2-1build1	None known
`nextcloud-desktop` Ubuntu:22.04:LTS	All versions, plus listed versions 3.2.3-0ubuntu13.3.5-13.3.5-1ubuntu13.4.2-13.4.2-1ubuntu1	None known
`nextcloud-desktop` Ubuntu:24.04:LTS	All versions, plus listed versions 3.9.0-13.10.0-13.11.0-13.11.0-1.1build33.11.0-1.1build4	None known
`nextcloud-desktop` Ubuntu:25.10	All versions, plus listed versions 3.16.0-13.16.2-13.16.4-13.16.6-13.16.6-3	None known
`nextcloud-desktop` Ubuntu:26.10	All versions, plus listed versions 4.0.6-133.0.2-133.0.7-1ubuntu1	None known
`nextcloud-desktop` Ubuntu:26.04:LTS	All versions, plus listed versions 3.16.6-33.16.7-14.0.1-24.0.1-2build14.0.6-1	None known

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`nextcloud-desktop` SUSE:Package Hub 15 SP4	before 3.8.0-bp154.2.3.1	3.8.0-bp154.2.3.1
`nextcloud-desktop` openSUSE:Leap 15.4	before 3.8.0-bp154.2.3.1	3.8.0-bp154.2.3.1
`nextcloud-desktop` SUSE:Package Hub 15 SP5	before 3.8.0-bp155.2.3.1	3.8.0-bp155.2.3.1
`nextcloud-desktop` openSUSE:Leap 15.5	before 3.8.0-bp155.2.3.1	3.8.0-bp155.2.3.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-39333 is a medium vulnerability (CVSS 4.6) in Nextcloud Desktop, published November 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in nextcloud-desktop 3.6.1-1.

References

Show 16 moreShow less

This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.