Nextcloud Server
Collaboration · products/nextcloud.yaml · RSS
Latest 35.0.2 Oct 15, 2026
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 35 | 35.0.2 | Sep 16, 2026 | Sep 30, 2027 · maintained |
| 34 | 34.0.5 | Jun 9, 2026 | Jun 30, 2027 · maintained |
| 33 | 33.0.10 | Feb 18, 2026 | Feb 28, 2027 · maintained |
| 32 | 32.0.15 | Sep 27, 2025 | Sep 30, 2026 · ended |
| 31 | 31.0.14 | Feb 25, 2025 | Feb 28, 2026 · ended |
| 30 | 30.0.17 | Sep 11, 2024 | Oct 31, 2025 · ended |
| 29 | 29.0.16 | Apr 24, 2024 | Apr 30, 2025 · ended |
| 28 | 28.0.14 | Dec 12, 2023 | Dec 31, 2024 · ended |
| 27 | 27.1.11 | Jun 13, 2023 | Jun 30, 2024 · ended |
| 26 | 26.0.13 | Mar 21, 2023 | Mar 31, 2024 · ended |
| 25 | 25.0.13 | Oct 19, 2022 | Oct 31, 2023 · ended |
| 24 | 24.0.12 | May 3, 2022 | Apr 30, 2023 · ended |
| 23 | 23.0.12 | Nov 30, 2021 | Dec 31, 2022 · ended |
| 22 | 22.2.10 | Jul 6, 2021 | Jul 31, 2022 · ended |
| 21 | 21.0.1 | Feb 22, 2021 | Feb 28, 2022 · ended |
| 20 | 20.0.4 | Oct 3, 2020 | Nov 30, 2021 · ended |
| 19 | 19.0.6 | Jun 3, 2020 | Jun 30, 2021 · ended |
| 18 | 18.0.12 | Jan 16, 2020 | Jan 31, 2021 · ended |
| 17 | 17.0.10 | Sep 30, 2019 | Oct 31, 2020 · ended |
| 16 | 16.0.11 | Apr 25, 2019 | Jun 30, 2020 · ended |
| 15 | 15.0.14 | Dec 10, 2018 | Dec 31, 2019 · ended |
| 14 | 14.0.14 | Sep 10, 2018 | Sep 30, 2019 · ended |
| 13 | 13.0.0 | Feb 6, 2018 | Feb 28, 2019 · ended |
| 12 | 12.0.13 | May 22, 2017 | Nov 30, 2018 · ended |
| 11 | 11.0.2 | Dec 13, 2016 | Mar 31, 2018 · ended |
| 10 | 10.0.4 | Aug 25, 2016 | Aug 31, 2017 · ended |
| 9 | 9.0.57 | Aug 3, 2016 | Aug 31, 2017 · ended |
Recent releases
breakingRemove usage of static vars or properties (server#59002)
security[master] fix(security): Update code signing revocation list (server#60705)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#60735)
securityMaster] fix(security): Update code signing revocation list (server#64464)
securityMaster] fix(security): Update code signing revocation list (server#64721)
securityMaster] fix(security): Update code signing revocation list (server#63358)
securityMaster] fix(security): Update code signing revocation list (server#63364)
securityMaster] fix(security): Update code signing revocation list (server#63370)
securityMaster] fix(security): Update code signing revocation list (server#62652)
securityMaster] fix(security): Update code signing revocation list (server#62040)
securityMaster] fix(security): Update code signing revocation list (server#62046)
securityMaster] fix(security): Update code signing revocation list (server#62184)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105)
securityMaster] fix(security): Update code signing revocation list (server#61133)
securityMaster] fix(security): Update code signing revocation list (server#61239)
breakingChore!: drop jQuery UI and jQuery (server#57648)
breakingRemove external shares from share list (server#58204)
breakingRemove leftover useless path assignements in View (server#58835)
securityMaster] fix(security): Update code signing revocation list (server#64465)
securityMaster] fix(security): Update code signing revocation list (server#64720)
securityMaster] fix(security): Update code signing revocation list (server#63357)
securityMaster] fix(security): Update code signing revocation list (server#63363)
securityMaster] fix(security): Update code signing revocation list (server#63369)
securityMaster] fix(security): Update code signing revocation list (server#62653)
securityMaster] fix(security): Update code signing revocation list (server#62041)
securityMaster] fix(security): Update code signing revocation list (server#62047)
securityMaster] fix(security): Update code signing revocation list (server#62185)
securityMaster] fix(security): Update code signing revocation list (server#61002)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104)
securityMaster] fix(security): Update code signing revocation list (server#61134)
Security advisories
6.8 CVE-2026-45810 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…
5.9 CVE-2026-45690 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
5.9 CVE-2026-45691 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
8.1 CVE-2026-45281 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
6.5 CVE-2026-45282 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
6.3 CVE-2026-45283 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the…
6.4 CVE-2026-45285 Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
4.4 CVE-2026-45279 Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…
4.3 CVE-2025-64011 Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other u…
4.3 CVE-2025-66547 Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via…
4.3 CVE-2025-66552 Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app t…
4.5 CVE-2025-66510 Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont…
5.4 CVE-2025-66512 Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…
6.4 CVE-2025-59788 Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…
4.3 CVE-2025-47793 Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.…
2.6 CVE-2025-47794 Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13…
4.3 CVE-2025-47791 Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently…
6.4 CVE-2025-47790 Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3…
2.6 CVE-2024-52513 Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in T…
4.1 CVE-2024-52514 Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the int…