{"id":"CVE-2016-9460","aliases":["EUVD-2016-10266","GHSA-2pf4-8974-rw6g"],"status":"published","title":"Nextcloud Server before 9.0.52 \u0026 ownCloud Server before 9.0.4 are vulnerable to a content...","description":"Nextcloud Server before 9.0.52 \u0026 ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01681,"percentile":0.77097,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-451"],"published":"2017-03-28T02:46:00Z","modified":"2026-10-24T10:49:25Z","products":[{"vendor":"nextcloud","product":"nextcloud"},{"vendor":"owncloud","product":"owncloud"}],"references":[{"url":"https://hackerone.com/reports/145463","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/nextcloud/server/commit/8aa0832bd449c44ec300da4189bd8ed4e036140c","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2016-013","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://nextcloud.com/security/advisory/?id=nc-sa-2016-003","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/97282","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://github.com/nextcloud/server/commit/dea8e29289a1b99d5e889627c2e377887f4f2983","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/owncloud/core/commit/c92c234059f8b1dc7d53122985ec0d398895a2cf","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/nextcloud/server/commit/2da43e3751576bbc838f238a09955c4dcdebee8e","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9460"},{"url":"https://github.com/advisories/GHSA-2pf4-8974-rw6g"}],"sources":{"cve":[{"id":"CVE-2016-9460","description":"Nextcloud Server before 9.0.52 \u0026 ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.","status":"published","published":"2017-03-28T02:46:00Z","modified":"2024-08-06T02:50:38.345Z","cwes":["CWE-451"],"updated_at":"2026-11-02T14:33:32.103757Z"}],"euvd":[{"id":"EUVD-2016-10266","description":"Nextcloud Server before 9.0.52 \u0026 ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.","status":"published","published":"2017-03-28T02:46:00Z","modified":"2024-08-06T02:50:38Z","updated_at":"2026-11-03T02:22:27.235814Z"}],"ghsa":[{"id":"GHSA-2pf4-8974-rw6g","title":"Nextcloud Server before 9.0.52 \u0026 ownCloud Server before 9.0.4 are vulnerable to a content...","description":"Nextcloud Server before 9.0.52 \u0026 ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.","status":"published","published":"2022-05-17T02:52:21Z","modified":"2025-04-20T03:34:57Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-284","CWE-451"],"updated_at":"2026-11-02T15:01:42.453698Z"}],"nvd":[{"id":"CVE-2016-9460","description":"Nextcloud Server before 9.0.52 \u0026 ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.","status":"published","published":"2017-03-28T02:59:00.793Z","modified":"2026-06-17T00:56:06.71Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-451","CWE-284"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-9460","description":"Nextcloud Server before 9.0.52 \u0026 ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.","status":"published","published":"2017-03-28T02:59:00.793Z","modified":"2026-10-24T10:49:25.452922112Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.472693Z"}]}}