Nextcloud Server 22.2.10 → 35.0.2

169 releases · 48 breaking changes · 307 security fixes · 9 advisories fixed

307security48breaking13deprecated534feature935fix

Is 22.2.10 affected?

Vulnerabilities fixed by this upgrade

3.0 CVE-2024-22403 Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any t…
6.0 CVE-2023-25579 Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The funct…
5.3 CVE-2023-25162 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.…
3.7 CVE-2023-25161 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missin…
4.0 CVE-2022-39364 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to ver…
4.8 CVE-2022-39330 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versi…
3.5 CVE-2022-39329 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable…
3.0 CVE-2022-39211 Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nex…
6.4 CVE-2022-36074 Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade.…

Breaking changes

breaking Remove usage of static vars or properties (server#59002) in 35.0.0
breaking Revert “fix(installer): re-enable version-incompatible apps after appstore update” (server#63773) in 35.0.0
breaking [master] fix(composer): Remove trailing comma breaking composer.json parsing (viewer#3271) in 35.0.0
breaking Chore!: drop jQuery UI and jQuery (server#57648) in 34.0.0
breaking Remove external shares from share list (server#58204) in 34.0.0
breaking Remove leftover useless path assignements in View (server#58835) in 34.0.0
breaking Remove static vars, first batch (server#59159) in 34.0.0
breaking Remove long-time deprecated methods (server#59544) in 34.0.0
breaking Chore!(core): remove deprecated Handlebars globals (server#59748) in 34.0.0
breaking Remove unneeded sort when listing mail/federated shares (server#60244) in 34.0.0
breaking Remove unneeded max-height from text-menubar which caused a bug (text#8311) in 34.0.0
breaking Remove unneeded sort when listing mail/federated shares (server#60356) in 33.0.4
breaking Debt(files): Remove regular stats request (server#56822) in 33.0.3
breaking Remove external shares from share list (server#58717) in 33.0.1
breaking Remove unneeded max-height from text-menubar which caused a bug (text#8351) in 33.0.1
breaking Chore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718) in 33.0.0
breaking Remove stable30 from dependabot (server#56018) in 33.0.0
breaking Debt(files): Remove regular stats request (server#56792) in 33.0.0
breaking Enhancement(files): remove redundant success toast on file rename (server#57168) in 33.0.0
breaking Refactor!: migrate files sidebar to Node API (server#57277) in 33.0.0
breaking Remove custom handling for public share pages with single files (files_pdfviewer#1206) in 31.0.5
breaking [stable31] test: Remove .only() calls in 31.0.2
breaking [stable31] fix: remove caching in fetchListOfGroups in 31.0.1
breaking [stable31] fix(l10n): Remove leading space from translation string in 31.0.1
breaking [stable30] test: Remove .only() calls in 30.0.8
breaking [stable30] fix(files): Ensure children are removed from folder and not duplicated in 30.0.2
breaking [stable30] fix(filesexternal): Remove unneeded 3rdparty library use in 30.0.2
breaking [stable30] fix(logger): Remove more parameters of other methods in 30.0.2
breaking [stable29] fix(files): Ensure children are removed from folder and not duplicated in 29.0.9
breaking [stable29] fix(logger): Remove more parameters of other methods in 29.0.9
breaking [stable29] refactor(AccountIcon): Remove needless console.log in 29.0.8
breaking [stable29] fix(provisionning_api): Remove parameters that are not set into template in 29.0.6
breaking [stable28] fix(logger): Remove more parameters of other methods in 28.0.12
breaking [stable28] refactor(AccountIcon): Remove needless console.log in 28.0.11
breaking [stable28] fix(memcache): remove double $$ to fix error in 28.0.7
breaking [stable28] fix(CalDAV): remove UNKNOWN from room / resource consideration in 28.0.7
breaking [stable28] chore: Remove old theming migration steps as they are only needed once in 28.0.3
breaking [stable28] fix(manager): removed dead code in 28.0.2
breaking [stable28] enh(breadcrumbs): removed unnecessary aria label in 28.0.2
breaking [stable28] enh(settings): removed background-gradient to ensure contrast ratio a… in 28.0.2
breaking [stable28] fix(files): remove focus outline on file list item click and make the link focusable in 28.0.2
breaking [stable27] chore: Remove old theming migration steps as they are only needed once in 27.1.7
breaking [stable27] fix(backupcodes): Remove old notifications before creating a new remi… in 27.1.5
breaking Remove leading slash (server#40856) in 27.1.3
breaking [stable27] fix(notifications): Remove share notification when the node is deleted in 27.1.0
breaking [stable27] fix(cache): Remove displayname cache entry on delete in 27.1.0
breaking [stable26] fix(backupcodes): Remove old notifications before creating a new remi… in 26.0.9
breaking Remove leading slash (server#40862) in 26.0.8

Security changes

security [master] fix(security): Update code signing revocation list (server#60705) in 35.0.0
security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#60735) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#60992) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#61088) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#61227) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#61268) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#61423) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#61900) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#62019) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#62166) in 35.0.0
security [master] fix(security): Update CA certificate bundle (server#62256) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#62632) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#62857) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#63142) in 35.0.0
security [master] fix(security): Update CA certificate bundle (server#63231) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#63335) in 35.0.0
security [master] fix(security): Update code signing revocation list (server#63485) in 35.0.0
security Fix(security): Update code signing revocation list (server#64051) in 35.0.0
security Master] fix(security): Update code signing revocation list (server#64464) in 34.0.5
security Master] fix(security): Update code signing revocation list (server#64721) in 34.0.5
security Master] fix(security): Update code signing revocation list (server#63358) in 34.0.4
security Master] fix(security): Update code signing revocation list (server#63364) in 34.0.4
security Master] fix(security): Update code signing revocation list (server#63370) in 34.0.4
security Master] fix(security): Update code signing revocation list (server#63521) in 34.0.4
security Master] fix(security): Update code signing revocation list (server#64097) in 34.0.4
security Master] fix(security): Update code signing revocation list (server#62652) in 34.0.3
security Master] fix(security): Update code signing revocation list (server#62040) in 34.0.2
security Master] fix(security): Update code signing revocation list (server#62046) in 34.0.2
security Master] fix(security): Update code signing revocation list (server#62184) in 34.0.2
security Master] fix(security): Update CA certificate bundle (server#62437) in 34.0.2
security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105) in 34.0.1
security Master] fix(security): Update code signing revocation list (server#61133) in 34.0.1
security Master] fix(security): Update code signing revocation list (server#61239) in 34.0.1
security Master] fix(security): Update code signing revocation list (server#61283) in 34.0.1
security Master] fix(security): Update code signing revocation list (server#61429) in 34.0.1
security Fix(SecurityMiddleware): return header to distinguish error type (server#58869) in 34.0.0
security Fix(security): Update Expires time (server#60397) in 34.0.0
security Master] fix(security): Update code signing revocation list (server#61001) in 34.0.0
security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476) in 34.0.0
security Master] fix(security): Update code signing revocation list (server#64465) in 33.0.10
security Master] fix(security): Update code signing revocation list (server#64720) in 33.0.10
security Master] fix(security): Update code signing revocation list (server#63357) in 33.0.9
security Master] fix(security): Update code signing revocation list (server#63363) in 33.0.9
security Master] fix(security): Update code signing revocation list (server#63369) in 33.0.9
security Master] fix(security): Update code signing revocation list (server#63520) in 33.0.9
security Master] fix(security): Update code signing revocation list (server#64098) in 33.0.9
security Master] fix(security): Update code signing revocation list (server#62653) in 33.0.8
security Master] fix(security): Update code signing revocation list (server#62041) in 33.0.7
security Master] fix(security): Update code signing revocation list (server#62047) in 33.0.7
security Master] fix(security): Update code signing revocation list (server#62185) in 33.0.7
security Master] fix(security): Update CA certificate bundle (server#62436) in 33.0.7
security Master] fix(security): Update code signing revocation list (server#61002) in 33.0.6
security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104) in 33.0.6
security Master] fix(security): Update code signing revocation list (server#61134) in 33.0.6
security Master] fix(security): Update code signing revocation list (server#61238) in 33.0.6
security Master] fix(security): Update code signing revocation list (server#61284) in 33.0.6
security Master] fix(security): Update code signing revocation list (server#61430) in 33.0.6
security Fix(security): Update Expires time (server#60396) in 33.0.4
security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580) in 33.0.4
security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 33.0.3
security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 33.0.3
security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 33.0.3
security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 33.0.3
security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 33.0.3
security Fix(security): Update Expires time (server#54868) in 33.0.3
security Fix(security): Update CA certificate bundle (server#54982) in 33.0.3
security Fix(security): Update code signing revocation list (server#55051) in 33.0.3
security Fix(security): Update code signing revocation list (server#55445) in 33.0.3
security Fix(security): Update CA certificate bundle (server#56209) in 33.0.3
security Fix(security): Update code signing revocation list (server#56365) in 33.0.3
security Fix(security): Update CA certificate bundle (server#56812) in 33.0.3
security Fixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the… in 33.0.1
security Fix(SecurityMiddleware): return header to distinguish error type (server#58880) in 33.0.1
security [master] fix(security): Update CA certificate bundle (server#54992) in 33.0.0
security [master] fix(security): Update code signing revocation list (server#55056) in 33.0.0
security [master] fix(security): Update code signing revocation list (server#55446) in 33.0.0
security [master] fix(security): Update CA certificate bundle (server#56211) in 33.0.0
security [master] fix(security): Update code signing revocation list (server#56363) in 33.0.0
security [master] fix(security): Update CA certificate bundle (server#56811) in 33.0.0
security [master] fix(security): Update code signing revocation list (server#57031) in 33.0.0
security [master] fix(security): Update code signing revocation list (server#57262) in 33.0.0
security [master] fix(security): Update code signing revocation list (server#57380) in 33.0.0
security Fix(security): Update Expires time (server#57688) in 33.0.0
security Fix(security): Update code signing revocation list (server#57948) in 33.0.0
security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 32.0.9
security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 32.0.9
security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 32.0.9
security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 32.0.9
security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 32.0.9
security Fixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf… in 32.0.4
security Fixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica… in 32.0.3
security Fixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont… in 32.0.3
security Fixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the… in 32.0.2
security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 32.0.1
security Fixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont… in 32.0.1
security Fixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf… in 31.0.14
security Fixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica… in 31.0.12
security Fixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont… in 31.0.12
security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 31.0.10
security Fixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont… in 31.0.10
security Fixes CVE-2025-47790: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3… in 31.0.3
security Fixes CVE-2025-66547: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via… in 31.0.1
security Fixes CVE-2025-66552: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app t… in 31.0.1
security Fixes CVE-2025-47794: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13… in 31.0.1
security [stable31] fix(security): Update CA certificate bundle in 31.0.1
security Fix A+ rating when checking with Nextcloud Security Scan. in 31.0.1
security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 30.0.17
security [stable30] fix(security): Update code signing revocation list in 30.0.10
security Fixes CVE-2025-47790: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3… in 30.0.9
security Fixes CVE-2025-66552: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app t… in 30.0.9
security Fixes CVE-2025-47794: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13… in 30.0.7
security [stable30] fix(security): Update CA certificate bundle in 30.0.7
security Fixes CVE-2025-47791: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently… in 30.0.3
security [stable30] fix(net/security): Handle IPv6 zone IDs in link-local addresses in 30.0.3
security [stable30] fix(security): Update CA certificate bundle in 30.0.3
security Fixes CVE-2024-52523: Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the fronte… in 30.0.2
security Fixes CVE-2024-52518: Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external stor… in 30.0.2
security Fixes CVE-2025-47793: Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.… in 30.0.2
security Fixes CVE-2024-52525: Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved… in 30.0.2
security [stable30] fix(security): Update code signing revocation list in 30.0.2
security Fixes CVE-2024-52517: Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain… in 30.0.1
security Fixes CVE-2024-52513: Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in T… in 30.0.1
security [stable30] fix(security): Update CA certificate bundle in 30.0.1
security [stable29] fix(security): Update code signing revocation list in 29.0.16
security Fixes CVE-2025-47790: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3… in 29.0.15
security Fixes CVE-2025-47794: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13… in 29.0.13
security [stable29] fix(security): Update CA certificate bundle in 29.0.13
security Fixes CVE-2025-47791: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently… in 29.0.10
security [stable29] fix(security): Update CA certificate bundle in 29.0.10
security Fixes CVE-2024-52523: Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the fronte… in 29.0.9
security Fixes CVE-2024-52518: Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external stor… in 29.0.9
security Fixes CVE-2025-47793: Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.… in 29.0.9
security Fixes CVE-2024-52525: Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved… in 29.0.9
security [stable29] fix(security): Update code signing revocation list in 29.0.9
security Fixes CVE-2024-52517: Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain… in 29.0.8
security Fixes CVE-2024-52513: Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in T… in 29.0.8
security [stable29] fix(security): Update CA certificate bundle in 29.0.8
security Fixes CVE-2024-52520: Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find ope… in 29.0.7
security Fixes CVE-2024-52519: Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextclou… in 29.0.7
security Fixes CVE-2024-52521: Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely be… in 29.0.7
security Fixes CVE-2024-52516: Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously… in 29.0.5
security Fix(security): Update expiration date in security.txt (server#47230) in 29.0.5
security Fixes CVE-2024-52515: Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If… in 29.0.1
security Fixes CVE-2025-47791: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently… in 28.0.13
security [stable28] fix(security): Update CA certificate bundle in 28.0.13
security Fixes CVE-2024-52523: Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the fronte… in 28.0.12
security Fixes CVE-2024-52518: Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external stor… in 28.0.12
security Fixes CVE-2025-47793: Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.… in 28.0.12
security Fixes CVE-2024-52525: Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved… in 28.0.12
security [stable28] fix(security): Update code signing revocation list in 28.0.12
security Fixes CVE-2024-52517: Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain… in 28.0.11
security Fixes CVE-2024-52513: Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in T… in 28.0.11
security [stable28] fix(security): Update CA certificate bundle in 28.0.11
security Fixes CVE-2024-52520: Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find ope… in 28.0.10
security Fixes CVE-2024-52519: Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextclou… in 28.0.10
security Fixes CVE-2024-52521: Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely be… in 28.0.10
security Fixes CVE-2024-52516: Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously… in 28.0.9
security Fix(security): Update expiration date in security.txt (server#47231) in 28.0.9
security Fixes CVE-2024-52515: Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If… in 28.0.6
security Fixes CVE-2024-37887: Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.… in 28.0.6
security Fixes CVE-2024-52514: Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the int… in 28.0.5
security Fixes CVE-2024-37882: Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server… in 28.0.4
security Fixes CVE-2024-37313: Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommen… in 28.0.4
security Fixes CVE-2024-37884: Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended th… in 28.0.4
security Fixes CVE-2024-37315: Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is re… in 28.0.3
security [stable28] fix(security): Update code signing revocation list in 28.0.3
security [stable28] fix(security): Describe occ security:bruteforce:attempts accurately in 28.0.3
security [stable28] fix(security): Update code signing revocation list in 28.0.2
security [stable28] fix(security): Update CA certificate bundle in 28.0.1
security Fixes CVE-2024-22403: Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any t… in 28.0.0
security Fixes CVE-2024-52514: Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the int… in 27.1.9
security Fixes CVE-2024-37882: Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server… in 27.1.8
security Fixes CVE-2024-37313: Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommen… in 27.1.8
security Fixes CVE-2024-37884: Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended th… in 27.1.8
security Fixes CVE-2024-37315: Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is re… in 27.1.7
security [stable27] fix(security): Update code signing revocation list in 27.1.7
security [stable27] fix(security): Describe occ security:bruteforce:attempts accurately in 27.1.7
security [stable27] fix(security): Update code signing revocation list in 27.1.6
security fix(security): Update expiration date in security.txt in 27.1.5
security [stable27] fix: Show error message when CSRF check fails at login in 27.1.5
security [stable27] fix(security): Handle idn_to_utf8 returning false in 27.1.5
security [stable27] fix(security): Update CA certificate bundle in 27.1.5
security Fixes CVE-2023-49791: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to version… in 27.1.4
security Fixes CVE-2023-49792: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to version… in 27.1.4
security Fixes CVE-2023-48239: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in… in 27.1.3
security Fixes CVE-2023-48301: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud E… in 27.1.3
security Fixes CVE-2023-48302: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud E… in 27.1.3
security Fixes CVE-2023-48306: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in… in 27.1.0
security Fixes CVE-2023-48304: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in… in 27.1.0
security Fixes CVE-2023-48305: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud E… in 27.1.0
security Fixes CVE-2023-48303: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud E… in 27.1.0
security [stable27] fix(security): Update CA certificate bundle in 27.1.0
security [stable27] feat(security): Add a bruteforce protection backend base on memcache in 27.1.0
security Fixes CVE-2024-37882: Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server… in 26.0.13
security Fixes CVE-2024-37313: Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommen… in 26.0.13
security Fixes CVE-2024-37884: Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended th… in 26.0.13
security Fixes CVE-2024-37315: Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is re… in 26.0.12
security [stable26] fix(security): Update code signing revocation list in 26.0.12
security [stable26] fix(security): Update code signing revocation list in 26.0.11
security [stable26] fix(security): Update expiration date in security.txt in 26.0.10
security [stable26] fix(security): Handle idn_to_utf8 returning false in 26.0.10
security [stable26] fix(security): Update CA certificate bundle in 26.0.10
security Fixes CVE-2023-49791: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to version… in 26.0.9
security Fixes CVE-2023-49792: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to version… in 26.0.9
security Fixes CVE-2023-48239: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in… in 26.0.8
security Fixes CVE-2023-48301: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud E… in 26.0.8
security Fixes CVE-2023-48302: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud E… in 26.0.8
security Fixes CVE-2023-48306: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in… in 26.0.6
security Fixes CVE-2023-48304: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in… in 26.0.6
security Fixes CVE-2023-45148: Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier th… in 26.0.6
security Fixes CVE-2023-48305: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud E… in 26.0.6
security Fixes CVE-2023-48303: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud E… in 26.0.6
security Fixes CVE-2023-39963: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9… in 26.0.4
security Fixes CVE-2023-39962: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.… in 26.0.4
security Fixes CVE-2023-39958: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, m… in 26.0.4
security Fixes CVE-2023-39960: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server st… in 26.0.4
security Fixes CVE-2023-39959: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a… in 26.0.4
security Fixes CVE-2023-39961: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an ima… in 26.0.4
security Fixes CVE-2023-45151: Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially… in 26.0.3
security Fixes CVE-2023-39952: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a… in 26.0.3
security Fixes CVE-2023-35172: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 an… in 26.0.2
security Fixes CVE-2023-32320: Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty req… in 26.0.2
security Fixes CVE-2023-35928: Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Ser… in 26.0.2
security Fixes CVE-2023-35927: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 an… in 26.0.2
security Fixes CVE-2023-35171: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could s… in 26.0.2
security Fixes CVE-2024-37314: Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud… in 26.0.2
security Fixes CVE-2023-48239: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in… in 25.0.13
security Fixes CVE-2024-37315: Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is re… in 25.0.13
security Fixes CVE-2023-48301: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud E… in 25.0.13
security Fixes CVE-2023-48302: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud E… in 25.0.13
security Fixes CVE-2023-48306: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in… in 25.0.11
security Fixes CVE-2023-48304: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in… in 25.0.11
security Fixes CVE-2023-45148: Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier th… in 25.0.11
security Fixes CVE-2023-48305: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud E… in 25.0.11
security Fixes CVE-2023-48303: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud E… in 25.0.11
security Fixes CVE-2023-39963: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9… in 25.0.9
security Fixes CVE-2023-39962: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.… in 25.0.9
security Fixes CVE-2023-39958: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, m… in 25.0.9
security Fixes CVE-2023-39960: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server st… in 25.0.9
security Fixes CVE-2023-39959: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a… in 25.0.9
security Fixes CVE-2023-39961: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an ima… in 25.0.9
security Fixes CVE-2023-45151: Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially… in 25.0.8
security Fixes CVE-2023-39952: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a… in 25.0.8
security Fixes CVE-2023-35172: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 an… in 25.0.7
security Fixes CVE-2023-32320: Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty req… in 25.0.7
security Fixes CVE-2023-35928: Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Ser… in 25.0.7
security Fixes CVE-2023-35927: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 an… in 25.0.7
security Fixes CVE-2024-37314: Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud… in 25.0.7
security Fixes CVE-2023-32318: Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cooki… in 25.0.6
security Fixes CVE-2023-32319: Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the p… in 25.0.5
security Fixes CVE-2023-30539: Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are syste… in 25.0.5
security Fixes CVE-2023-28847: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server… in 25.0.5
security Fixes CVE-2023-26482: Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administr… in 25.0.4
security Fixes CVE-2023-28844: Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled… in 25.0.4
security Fixes CVE-2023-25818: Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations… in 25.0.4
security Fixes CVE-2023-25820: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud… in 25.0.4
security Fixes CVE-2023-28834: Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server 23.0.0 until 23.0.11, 24.0.0 until 24.… in 25.0.4
security Fixes CVE-2023-28835: Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when… in 25.0.4
security Fixes CVE-2023-28833: Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted an… in 25.0.4
security Fixes CVE-2023-28644: Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denia… in 25.0.3
security Fixes CVE-2023-28643: Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will r… in 25.0.3
security Fixes CVE-2023-25816: Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can configure a very long password, consumin… in 25.0.3
security Fixes CVE-2023-25579: Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The funct… in 25.0.2
security Fixes CVE-2023-32319: Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the p… in 24.0.11
security Fixes CVE-2023-30539: Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are syste… in 24.0.11
security Fixes CVE-2023-28847: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server… in 24.0.11
security Fixes CVE-2023-26482: Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administr… in 24.0.10
security Fixes CVE-2023-28844: Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled… in 24.0.10
security Fixes CVE-2023-25818: Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations… in 24.0.10
security Fixes CVE-2023-25820: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud… in 24.0.10
security Fixes CVE-2023-28834: Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server 23.0.0 until 23.0.11, 24.0.0 until 24.… in 24.0.10
security Fixes CVE-2023-28835: Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when… in 24.0.10
security Fixes CVE-2023-28833: Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted an… in 24.0.10
security Fixes CVE-2023-28643: Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will r… in 24.0.9
security Fixes CVE-2023-25817: Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deleta… in 24.0.9
security Fixes CVE-2023-25579: Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The funct… in 24.0.8
security Fixes CVE-2023-25162: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.… in 24.0.8
security Fixes CVE-2023-25161: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missin… in 24.0.8
security Fixes CVE-2023-25821: Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shar… in 24.0.7
security Fixes CVE-2022-41970: Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and p… in 24.0.7
security Fixes CVE-2022-41969: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator… in 24.0.7
security Fixes CVE-2022-39330: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versi… in 24.0.6
security Fixes CVE-2022-39364: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to ver… in 24.0.5
security Fixes CVE-2022-41968: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can se… in 24.0.5
security Fixes CVE-2022-39329: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable… in 24.0.5
security Fixes CVE-2022-39211: Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nex… in 24.0.4
security Fixes CVE-2022-36074: Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade.… in 24.0.3
security Fixes CVE-2022-39346: Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing… in 24.0.3
security Fixes CVE-2022-31118: Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access t… in 24.0.2
security Fixes CVE-2023-25579: Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The funct… in 23.0.12
security Fixes CVE-2023-25162: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.… in 23.0.12
security Fixes CVE-2023-25161: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missin… in 23.0.12
security Fixes CVE-2022-41969: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator… in 23.0.11
security Fixes CVE-2022-39330: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versi… in 23.0.10
security Fixes CVE-2022-41968: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can se… in 23.0.10
security Fixes CVE-2022-39364: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to ver… in 23.0.9
security Fixes CVE-2022-39329: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable… in 23.0.9
security Fixes CVE-2022-39211: Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nex… in 23.0.8
security Fixes CVE-2022-36074: Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade.… in 23.0.7
security Fixes CVE-2022-39346: Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing… in 23.0.7
security Fixes CVE-2022-31118: Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access t… in 23.0.6
security Fixes CVE-2022-31014: Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the bac… in 23.0.5
security Fixes CVE-2022-29243: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users… in 23.0.4
security Fixes CVE-2022-31120: Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share even… in 23.0.4
security Fixes CVE-2022-29163: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if… in 23.0.3
security Fixes CVE-2022-24888: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders… in 23.0.1
security Fixes CVE-2022-24889: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "… in 23.0.1

Deprecations

deprecated Deprecate long, non-lazy app config and user config (server#65012) in 35.0.2
deprecated Fix deprecations in tests (server#61140) in 35.0.0
deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1264) in 34.0.0
deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1268) in 33.0.1
deprecated Port away from deprecated Doctrine APIs (server#55674) in 33.0.0
deprecated Cleanup unused code and deprecated imports (text#7752) in 33.0.0
deprecated [stable30] fix(repair): PHP8.3 deprecation warning in 30.0.7
deprecated [stable30] fix(Middleware): log deprecation when annotation was actually used in 30.0.3
deprecated [stable29] fix(repair): PHP8.3 deprecation warning in 29.0.13
deprecated Deprecated sysconfig 'enable_file_metadata' (server#44124) in 28.0.4
deprecated [stable28] Move away from deprecated utf8_encode() on PHP 8.2+ in 28.0.3
deprecated [stable27] Move away from deprecated utf8_encode() on PHP 8.2+ in 27.1.7
deprecated [stable27] fix(utility): De- deprecate getDateTime and getTime as now() only returns DateTimeImmutable in 27.1.0

Every release in between

35.0.2 Oct 15, 2026 Release notes ↗

fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64322)

fixFix(files_sharing): name the parent folder in inherited unshare actions (server#64349)

fixFix(files_sharing): cap share presets to the permissions the resharer (server#64482)

fixFix(encryption): keep version and size in sync for files not in the cache (server#64485)

featurePerf(setupchecks): Don’t load all tasks to calculate stats (server#64609)

fixFix: forbid newline characters in filenames (server#64613)

fixFix: correct cast ttl to int in KeyValueCache (server#64615)

featureAdd API to generate system report section (server#64631)

fixFix(auth): keep remember-me cookies pointing at a live session token (server#64649)

fixFix: never block simple renames in SharesPlugin (server#64681)

featureFeat(upgrade): localize app names if available on upgrade page (server#64693)

fixFix(files): keep deleting live photo peers after a missing one (server#64699)

fixFix(files_sharing): render share suggestion avatar when provided (server#64704)

fixFix(setupcheck): Print verbose info to allow finding out memory issues (server#64751)

featureFeat: add additional metadata to node webhooks (server#64847)

fixFix(EmojiHelper): exclude non-latin letters from EmojiHelper (server#64866)

featureFeat: make comment events webhook compatible (server#64868)

fixFix(Sharing): Fix recipient IDs on 32-bits (server#64870)

fixFix(files_external): preserve boolean mount options (server#64879)

fixFix(SchemaChecker): don’t block on unexpected-table finding (server#64891)

fixFix(adminaudit): Allow named placeholders via CriticalActionPerformedEvent (server#64895)

fixFix(cache): Check if $entry[‘fileid’] exists (server#64902)

fixFix(user_ldap): show %uid instead of %%uid in the login filter hint (server#64913)

fixFix: Make all app versions stable (server#64915)

featurePerf(files): Only match search results against caches of their storage (server#64916)

featureFeat(files-search): Add push down negation optimizer (server#64923)

featureFeat: Add code integrity background job (server#64974)

deprecatedDeprecate long, non-lazy app config and user config (server#65012)

featurePerf: Optimize deleting the list of invalid shares (server#65137)

featureFeat: Add IAccountScopedSearchProvider (server#65313)

featureFeat: Build js after merge (activity#2998)

featurePerf: Cache public share (activity#3004)

featurePerf: Use startActivityTransaction in a few more places (activity#3016)

featureFeat: Build js after merge (circles#2978)

featureFeat(workflow): Add fixup block (circles#2989)

featureFeat: Bump pdf js (files_pdfviewer#1567)

featureFeat: expose Nextcloud AIO version in info API (serverinfo#1189)

featurePerf: get all markdown files in one SQL query (text#9291)

featurePerf(session): fetch document only once in SessionMiddleware (text#9295)

featureFeat(edit): collaborate in other apps(deck) (text#9325)

+102 more items in the release notes

35.0.1 Sep 24, 2026 Release notes ↗

fixFix(Sharing): Prevent truncation of node IDs (server#64140)

fixFix(trashbin): properly unpause trashbin on error (server#64177)

fixFix: update left padding of public shares (server#64213)

fixFix: update shared resource calendar icon for different theme (server#64288)

fixFix(i18n): Remove ellipsis from search strings (server#64323)

fixFix: preserve link shares on ownership transfer (server#64332)

featureAllow quota write streams with unknown free space (server#64341)

fixFix: remove nested items from favorites view on unfavorite (server#64344)

fixFix(Sharing): Hide non-matching recipients instead of only their secrets (server#64353)

fixFix(encryption): cap and invalidate key-cache (server#64356)

fixFix(files): Show confirmation dialog on delete hotkey press (server#64357)

fixFix(files_external): show that an unrestricted storage applies to all (server#64362)

fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64367)

fixFix: improve form validation feedback for login, account creation, and sharing (server#64372)

fixFix: show custom permissions when share is removed from edit bundle (server#64375)

fixFix: logs can leak sensitive information.. (server#64386)

fixFix: skip copying skeleton if the user has 0 quota (server#64396)

fixFix(files): bring back ownership transfer of all files (server#64407)

fixFix: use correct mimetype for theming logo (server#64410)

fixFix(files_sharing): only offer folders in file-request which are shareable (server#64416)

fixFix: scope group share child permission updates to usergroup (server#64417)

fixFix(sharing): Hide Allow download and sync option for federated (server#64421)

fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64425)

fixFix(previews): set Content-Type header for Imaginary requests (server#64431)

featureImplement recommended recipient api for unified sharing (server#64433)

fixFix(CalDAV): extract data from occurance exemptions (server#64438)

featureAdd files:list command and fix auto completion (server#64439)

fixFix(config): Don’t print sensitive config when setting them (server#64442)

featureFeat: Add more debug output when checkTokenCredentials fails (server#64472)

fixFix: keep share visible for share owner when iinitiator is deactivated (server#64477)

fixFix(filecache): announce every removed entry so metadata is cleaned up (server#64498)

fixFix(files): validate dropped filenames before upload (server#64502)

fixFix: remove dead hook listener and replace with event listener (server#64509)

fixFix(CalDAV): set significant change flag properly (server#64520)

featureFeat(files): bring back the Sidebar API (server#64581)

featurePerf: Improve token exchange (server#64597)

featureFeat: let apps define the actor of an activity via the activity manager (activity#2930)

featureAdd a vitest harness for the front-end (files_pdfviewer#1564)

featureFeat(api): Allow to filter the API by app and object (notifications#3389)

featureFeat(menu): add Mermaid diagram entry to Blocks menu (text#9204)

+34 more items in the release notes

35.0.0 Sep 15, 2026 Release notes ↗

featureAdd rel attribute for fediverse link to make verification possible. (server#43364)

featureFeat(deps): Upgrade phpseclib to v3 (server#48183)

featureFeat(occ): Better handling of disabled or unreacheable App store (server#49697)

featureFeat: Run setup checks by category or class (server#49978)

featureAdded parameter to disable web UI integration with local client (server#54191)

featureFeat: OCS Calendar Import (server#55178)

featureFeat(theming): add option for reduce animation (server#55406)

featureFeat(entity): Provide a new API for entities (server#56199)

featureAdded a exclude disabled option to last seen (server#57081)

featureFeat (2fa): Add IStatelessProvider interface (server#57216)

featureImplement token exchange from OCM (server#57234)

featureMove invite-accepted capability and implementation to contacts app. (server#57853)

featureFeat: delay fetching the display name of a share recipient untill we need it (server#58335)

featureFeat: frankenphp (server#58541)

featureFeat(lookup): search for local account only via lookupserver (server#58567)

breakingRemove usage of static vars or properties (server#59002)

featureEnh(occ): make it possible to add an arbitrary number of users to a g… (server#59271)

featureFeat(files_versions): allow to block version creation using WFE (server#59610)

featureFeat: allow setting custom login-name for occ generated app password (server#59680)

security[master] fix(security): Update code signing revocation list (server#60705)

securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#60735)

security[master] fix(security): Update code signing revocation list (server#60992)

security[master] fix(security): Update code signing revocation list (server#61088)

deprecatedFix deprecations in tests (server#61140)

security[master] fix(security): Update code signing revocation list (server#61227)

security[master] fix(security): Update code signing revocation list (server#61268)

security[master] fix(security): Update code signing revocation list (server#61423)

security[master] fix(security): Update code signing revocation list (server#61900)

security[master] fix(security): Update code signing revocation list (server#62019)

security[master] fix(security): Update code signing revocation list (server#62166)

security[master] fix(security): Update CA certificate bundle (server#62256)

security[master] fix(security): Update code signing revocation list (server#62632)

security[master] fix(security): Update code signing revocation list (server#62857)

security[master] fix(security): Update code signing revocation list (server#63142)

security[master] fix(security): Update CA certificate bundle (server#63231)

security[master] fix(security): Update code signing revocation list (server#63335)

security[master] fix(security): Update code signing revocation list (server#63485)

breakingRevert “fix(installer): re-enable version-incompatible apps after appstore update” (server#63773)

securityFix(security): Update code signing revocation list (server#64051)

breaking[master] fix(composer): Remove trailing comma breaking composer.json parsing (viewer#3271)

+2377 more items in the release notes

34.0.5 Oct 15, 2026 Release notes ↗

featureFeat(search): Subdue header search input placeholder (server#60833)

fixFix(files_sharing): Use share id in file actions (server#62403)

fixFix(dashboard): update scrollbar contrast on background (server#62630)

fixFix(encryption): bind personal private key password inputs (server#62672)

fixFix: allow Enter on public share Download link (server#62770)

fixFix: multiple file selection on tab navigation (server#63214)

fixFix: Combined Calendar and Contacts Import (server#63334)

fixFix: fail uploads when uri does not match session/share token (server#63960)

fixFix(files_external): map display names for groups (server#64010)

fixFix(sharing): Hide Allow download and sync option for federated (server#64013)

fixFix(tags): broken tag deletion on user delete (server#64089)

fixFix(metadata): bind chunked file ids in dropMetadataForFiles (server#64092)

fixFix: protect share accept endpoint with CSRF token (server#64107)

fixFix: remove wrongly used system address book flag (server#64131)

fixFix(files_sharing): normalize share target on parent folder rename (server#64143)

fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64146)

fixFix: update left padding of public shares (server#64212)

fixFix(ci): Pin 32-bit (server#64304)

fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64321)

fixFix: preserve link shares on ownership transfer (server#64330)

featureAllow quota write streams with unknown free space (server#64342)

fixFix: remove nested items from favorites view on unfavorite (server#64345)

fixFix(encryption): cap and invalidate key-cache (server#64355)

fixFix(files): Show confirmation dialog on delete hotkey press (server#64359)

fixFix(files_external): show that an unrestricted storage applies to all (server#64361)

fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64368)

fixFix: improve form validation feedback for login, account creation, and sharing (server#64373)

fixFix: show custom permissions when share is removed from edit bundle (server#64376)

fixFix: logs can leak sensitive information.. (server#64385)

fixFix: skip copying skeleton if the user has 0 quota (server#64397)

fixFix: use correct mimetype for theming logo (server#64409)

securityMaster] fix(security): Update code signing revocation list (server#64464)

featurePerf(setupchecks): Don’t load all tasks to calculate stats (server#64610)

featureAdd API to generate system report section (server#64632)

securityMaster] fix(security): Update code signing revocation list (server#64721)

featureFeat: add additional metadata to node webhooks (server#64846)

featurePerf(files): Only match search results against caches of their storage (server#64917)

featureFeat: Add code integrity background job (server#64973)

featureFeat(workflow): Add fixup block (circles#2988)

featurePerf(session): fetch document only once in SessionMiddleware (text#9296)

+106 more items in the release notes

34.0.4 Sep 10, 2026 Release notes ↗

fixFix(theming): mark background button text as English (server#62252)

fixFix(ocm): Move invite-accepted capability and implementation to contacts app (server#62486)

featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63155)

fixFix: make unified filter chip accessible (server#63224)

fixFix(preview): delete version metadata by preview ID (server#63290)

fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63310)

fixFix(group): Set the display name on every backends that supports it (server#63321)

fixFix(jobs): don’t overwrite the –stop_after baseline in background-job:worker (server#63328)

fixFix(config): mask the Euro-Office jwt_secret as sensitive (server#63332)

fixFix(preview): order previews by ID during pagination (server#63345)

fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63347)

securityMaster] fix(security): Update code signing revocation list (server#63358)

securityMaster] fix(security): Update code signing revocation list (server#63364)

securityMaster] fix(security): Update code signing revocation list (server#63370)

fixFix: Creating shares with multiple mount permissions (server#63372)

fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63378)

fixFix: allow file request upload when `part_file_in_storage=false` (server#63379)

fixFix: Public link with multiple mounts (server#63384)

featureFeat: Mark 32 bits support as removed for Nextcloud Hub 27 Winter (server#63387)

fixFix(preview): keep the local file when losing the insert race (server#63390)

fixFix(files_sharing): Use share password policy for password generation (server#63397)

fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63404)

featureFeat(dav): add IRoomMetadata::BUILDING_NAME (server#63419)

fixFix(files_reminder): passed reminder handling (server#63425)

fixFix: enhance name splitting to handle “Lastname, Firstname” format (server#63426)

fixFix(files_external): set usePresignedUrl before first S3 connection (server#63456)

securityMaster] fix(security): Update code signing revocation list (server#63521)

fixFix(preview): execute PreviewMapper::deleteAll() (server#63523)

fixFix(LocalStorage): Clear realpath cache on fopen failure and re-try access (server#63530)

fixFix(dav): Handle correctly not found while streaming output (server#63533)

fixFix(provisioning_api): let sub-admins change group memberships (server#63534)

fixFix(files): hide download action in link shares for newly created folders (server#63552)

featureFeat(updater): clear app_install_overwrite on major upgrades (server#63633)

fixFix(appconfig): make type-conflict error self-explanatory (server#63643)

fixFix(dav): scope contact photo export to local address books (server#63645)

fixFix cancelling the customization of a share (server#63658)

fixFix(dav): correctly mask public v1 links for non-home storages (server#63668)

fixFix(dav): only derive the write size from a PUT Content-Length (server#63678)

securityMaster] fix(security): Update code signing revocation list (server#64097)

featureAdd a vitest harness for the front-end (files_pdfviewer#1565)

+67 more items in the release notes

34.0.3 Aug 13, 2026 Release notes ↗

featurePerf: Replace more calls from getUserGroups to getUserGroupIds (server#62223)

fixFix: Output shape validation will delete keys when there is a list of files (server#62237)

fixFix(jobs): resolve portability issues with background job cleanup (server#62279)

fixFix(files_external/SMB): Use ‘null’ explicitly for no workgroup (server#62281)

fixFix(files): preserve encryptedVersion when copying cache entries (server#62337)

fixFix(preview): Handle unique constraints violation exception (server#62363)

fixFix(files_version): mtime confusion on milliseconds (server#62372)

fixFix(AmazonS3): pass S3 error messages through to the frontend (server#62418)

fixFix(SetupChecks): Link to task processing worker docs (server#62443)

fixFix: Don’t add empty and broken ExternalShareScanJob on upgrade (server#62451)

fixFix(background-jobs): preserve Snowflake IDs as strings (server#62457)

fixFix: harden object store against copying a file to itself (server#62461)

fixFix: Use PHP_AUTH_PW for strict password confirmation (server#62537)

featurePerf: Use hash map to check if path was already checked (server#62588)

fixFix(TaskProcessing): Claim tasks atomically in both SynchronousBackgr… (server#62608)

featurePerf(preview): Optimize retriving all previews from oc_filecache (server#62611)

fixFix(unified-search): catch errors in response (server#62616)

securityMaster] fix(security): Update code signing revocation list (server#62652)

fixFix(search): Add end date for last 7 and last 30 days (server#62685)

fixFix(caldav): Expand recurring events for principal calendar search (server#62693)

fixFix(MemcachedFactory): Enable TCP_NODELAY and adjust default timeouts to be reasonable (server#62702)

fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62714)

fixFix(imip): add context to imip log messages (server#62723)

fixFix(share-api-controller): add sanity check on canAccessShare for circle share types (server#62733)

fixFix(jobs): compute memory usage after clean-up (server#62768)

fixFix(metadata): bind chunked file ids (server#62771)

featurePerf(user-display-name): Check memory cache before trying redis (server#62778)

fixFix(encryption): Correctly report size for zero-byte encrypted files (server#62780)

fixFix(provisioning_api): read newUser.sendEmail as a boolean (server#62784)

fixFix(encryption): handle decryption exception with outdated passwords (server#62788)

fixFix(imip): don’t report success when a calendar cannot process iMip (server#62792)

fixFix(share): Avoid crash when share owner is not found (server#62798)

featureFeat: Add setting to bypass password confirmation on a selected ip ranges (server#62908)

featureFeat: Allow to check user existence outside specific user backends (server#62917)

featureFeat(lookup): search for local account only via lookupserver (server#62934)

featureFeat: allow specifying applicable users and groups in the files_external:create command (server#62949)

featureFeat(federation): Add accept/decline mechanism for federated calendars (server#63113)

featurePerf(files): compute move/rename activity settings once (activity#2794)

featureFeat: adding an option to exclude users from the acitivity log (activity#2808)

featurePerf(push): Send push notifications async to proxies (notifications#3246)

+83 more items in the release notes

34.0.2 Jul 23, 2026 Release notes ↗

fixFix(cypress): disable unsupported-browser redirect in test container (server#60807)

featureFeat(UserManager): Add getters for avatar URLs (server#60811)

fixFix(core): public share download icon color and theme filter scope (server#61211)

fixFix: use card interface instead of object (server#61252)

fixFix: properly mark CleanupShareTarget as expensive (server#61498)

fixFix: update cached mounts when moving share in repair step (server#61500)

fixFix(files_trashbin): create folder if missing when expiring trash (server#61523)

fixFix(files_sharing): remove filename’s leading slash on unshare toast (server#61528)

fixFix: stop calling DI container in SharedStorage (server#61529)

fixFix(preview): First cleanup from filecache and then from preview table (server#61531)

featurePerf(View): don’t sort twice the same array (server#61535)

featurePerf: block more properties from using the custom properties backend (server#61540)

fixFix(settings): correct heading order in account management sidebar (server#61546)

fixFix: Make the IProvideUserSecretBackend usable (server#61550)

fixFix: track time spent in recursive markOrRun calls (server#61553)

featurePerf(log): normalize log data only when logging (server#61557)

featurePerf: avoid DIing IRootFolder at every shared storage init (server#61558)

featurePerf: Only sort wrappers when adding them (server#61700)

featurePerf: Don’t fetch full group object in AuthorizedGroupMapper (server#61852)

featureFeat(OCP): Add Interaction API (server#61867)

featureFeat: Disable callable serialization in sabre/xml (server#61923)

featureFeat: Fetch groups in batch in getUserGroups (server#61936)

featureFeat(login): clean remember me tokens (server#61972)

securityMaster] fix(security): Update code signing revocation list (server#62040)

securityMaster] fix(security): Update code signing revocation list (server#62046)

featurePerf(carddav): reduce disk usage of photocache (server#62054)

featurePerf(workflow): Implement result cache for IP checks (server#62057)

featureFeat: KV cache based on predis (server#62070)

featureFeat(share): add public share-review API under OCP\Share\ShareReview (server#62132)

featurePerf: Don’t fetch all the trash items when deleting a single item (server#62180)

securityMaster] fix(security): Update code signing revocation list (server#62184)

featureFeat(files_sharing): schedule external share scan job when accepted (server#62197)

featurePerf(dav): Stream PROPFIND output (server#62224)

securityMaster] fix(security): Update CA certificate bundle (server#62437)

featureFeat: Disable callable serialization in sabre/xml (3rdparty#2513)

featureFeat: add predis as a dependency for Valkey cluster support (3rdparty#2518)

featureFeat: make amount of items sent on email configurable via occ (activity#2708)

featureFeat: add release relay gh workflow (app_api#924)

featureEnh: allow file owner to unlock TYPE_TOKEN locks (files_lock#1169)

featureFeat: Add login output when password policy fails (password_policy#966)

+351 more items in the release notes

34.0.1 Jun 25, 2026 Release notes ↗

fixFix: folder tree selection after any action in main content (server#60478)

fixFix(files): show proper information when a move will override the target (server#60963)

featurePerf(user_ldap): chunk oracle queries for lower bind cost (server#60978)

fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60983)

fixFix(theming): read cachebuster as int in manifest endpoint (server#61010)

fixFix(dav): finalize upload metadata before post-write hooks (server#61072)

fixFix(comments): load comments styles when the comments app is loaded (server#61076)

fixFix(dav): properly handle files metadata (server#61078)

fixFix(settings): Fix appstore icon color in settings menu (server#61093)

fixFix(comments): Use capped memory cache for comments (server#61097)

securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105)

fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61106)

fixFix: Correctly detect appid for dist css files (server#61113)

fixFix: use correct permissions mask for non-home storage public links (server#61118)

fixFix(settings): Show loading spinner while searching accounts (server#61122)

securityMaster] fix(security): Update code signing revocation list (server#61133)

featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61157)

fixFix(core): keep app menu settings icon legible on light backgrounds (server#61161)

fixFix(previews): ffprobe hangs (server#61182)

fixFix(files_versions): guard null path in event listeners (server#61189)

fixFix(repair): restrict unserialize() in RemoveBrokenProperties (server#61203)

fixFix(appstore): bring back “update all” button (server#61212)

fixFix(settings): clear NcAppNavigation toggle overhang (server#61234)

securityMaster] fix(security): Update code signing revocation list (server#61239)

featureFeat(settings): Require 8.3 for 35 (server#61241)

fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61243)

fixFix: Fix PHP Warning foreach() argument must be of type array|object, null given (server#61258)

securityMaster] fix(security): Update code signing revocation list (server#61283)

fixFix(twofactor_backupcodes): Add a clean helper to set code as used (server#61296)

fixFix(theming): preserve uploaded favicon and touch icon (server#61302)

fixFix: Use token expiration for ephemeral sessions (server#61305)

featureFeat(oauth2): Add commands for adding and deleting clients (server#61309)

fixFix(user_ldap): Escape filter part when searching for group members (server#61325)

featureAdd OCM Notification Received Event (server#61337)

fixFix: trim duplicate search results for external share (server#61340)

fixFix: Do not set last-password-confirm for apptoken sessions (server#61342)

fixFix(team-manager): ensure team resources are only retrived for members (server#61351)

securityMaster] fix(security): Update code signing revocation list (server#61429)

featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2636)

featurePerf: Avoir calling Server::get for each share mounts (files_lock#1123)

+50 more items in the release notes

34.0.0 Jun 8, 2026 Release notes ↗

featureFeat(filecache): Scale DB query created when deleting file from filecache (server#54277)

featureFeat: add oc-ownerid and oc-permissions headers on PUT DAV requests (server#54542)

featureAdd some missing attributes (server#55474)

featureFeat(preview): Expire previews (server#55632)

featureFeat(preview): On demand preview migration (server#55649)

featureAdd configs for strict PHP checks (server#56522)

featureFeat(app): allow removing installed-but-disabled apps; improve help & logging (server#56720)

featureFeat: improve calendar migrator (server#57112)

featureFeat: perform share mount validation on share instead of on mount (server#57295)

featureFeat(http-client): add option to add instance URL to HTTP client user-agent (server#57376)

featureFeat(mimetypes): Add mimetype aliases/mapping/names for .toml and .ovpn (server#57480)

featureFeat(external-storage): Implement IPartialMountPoint (server#57497)

featureAdd InstallationCompletedEvent for post-installation actions (server#57522)

featureFeat(user_picker): Move the profile picker to server (server#57539)

featureFeat: Add office switcher with feature comparison (server#57555)

featurePerf(normalization): Optimize path normalization (server#57570)

featureFeat(objectstore): Add AWS SSE-KMS encryption support for S3 storage (server#57623)

breakingChore!: drop jQuery UI and jQuery (server#57648)

featureFeat(files): render file list filters in top bar and allow to collapse into overflow menu (server#57664)

featureFeat: allow to filter contacts by team (server#57676)

featureFeat: Add twofactor applications to most of the presets (server#57737)

featureFeat(sharing): Make share permission in bundled edit configurable (server#57741)

featureFeat(openmetrics): add log level (server#57759)

featureFeat(contacts): support federated users/groups search when adding team members (server#57782)

featureFeat(flake): Add reuse cli (server#57800)

featureFeat: optimize user mount cache (server#57815)

featureFeat(OCP): Expose setup manager to OCP (server#57826)

featureFeat: Add SetupCheck to warn about missing second factor provider (server#57854)

breakingRemove external shares from share list (server#58204)

breakingRemove leftover useless path assignements in View (server#58835)

securityFix(SecurityMiddleware): return header to distinguish error type (server#58869)

breakingRemove static vars, first batch (server#59159)

breakingRemove long-time deprecated methods (server#59544)

breakingChore!(core): remove deprecated Handlebars globals (server#59748)

breakingRemove unneeded sort when listing mail/federated shares (server#60244)

securityFix(security): Update Expires time (server#60397)

securityMaster] fix(security): Update code signing revocation list (server#61001)

deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1264)

breakingRemove unneeded max-height from text-menubar which caused a bug (text#8311)

securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476)

+949 more items in the release notes

33.0.10 Oct 15, 2026 Release notes ↗

fixFix: track time spent in recursive markOrRun calls (server#61552)

fixFix(dashboard): update scrollbar contrast on background (server#62629)

fixFix(encryption): bind personal private key password inputs (server#62671)

fixFix: allow Enter on public share Download link (server#62769)

fixFix: multiple file selection on tab navigation (server#63213)

fixFix(cardDav): Only update user card on actual mapped propreties changes (server#63769)

fixFix: fail uploads when uri does not match session/share token (server#63961)

fixFix(files_external): map display names for groups (server#64009)

fixFix: Unknown cli option (server#64012)

fixFix(sharing): Hide Allow download and sync option for federated (server#64014)

fixFix(tags): broken tag deletion on user delete (server#64088)

fixFix: protect share accept endpoint with CSRF token (server#64108)

fixFix: remove wrongly used system address book flag (server#64130)

fixFix(files_sharing): normalize share target on parent folder rename (server#64142)

fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64147)

fixFix: update left padding of public shares (server#64211)

fixFix(ci): Pin 32-bit (server#64305)

fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64320)

fixFix: preserve link shares on ownership transfer (server#64329)

fixFix: remove nested items from favorites view on unfavorite (server#64346)

fixFix(encryption): cap and invalidate key-cache (server#64354)

fixFix(files): Show confirmation dialog on delete hotkey press (server#64358)

fixFix(files_external): show that an unrestricted storage applies to all (server#64360)

fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64366)

fixFix: show custom permissions when share is removed from edit bundle (server#64377)

fixFix: logs can leak sensitive information.. (server#64384)

fixFix(files_sharing): only offer folders in file-request which are shareable (server#64414)

fixFix: scope group share child permission updates to usergroup (server#64418)

fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64423)

fixFix(config): Don’t print sensitive config when setting them (server#64463)

securityMaster] fix(security): Update code signing revocation list (server#64465)

fixFix: keep share visible for share owner when iinitiator is deactivated (server#64475)

fixFix(files_sharing): cap share presets to the permissions the resharer (server#64480)

fixFix(encryption): keep version and size in sync for files not in the cache (server#64483)

fixFix(dav): keep tags on hidden files when setting tag object ids (server#64561)

featureAdd API to generate system report section (server#64633)

securityMaster] fix(security): Update code signing revocation list (server#64720)

featureFeat: add additional metadata to node webhooks (server#64845)

featurePerf(files): Only match search results against caches of their storage (server#64918)

featureFeat(workflow): Add fixup block (circles#2987)

+76 more items in the release notes

33.0.9 Sep 10, 2026 Release notes ↗

fixFix(ocm): Move invite-accepted capability and implementati… (server#62460)

fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62713)

featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63156)

fixFix(CalDAV): iTipBroker message generation and testing (server#63187)

fixFix(preview): delete version metadata by preview ID (server#63289)

fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63309)

fixFix: make unified filter chip accessible (server#63319)

fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63346)

securityMaster] fix(security): Update code signing revocation list (server#63357)

securityMaster] fix(security): Update code signing revocation list (server#63363)

securityMaster] fix(security): Update code signing revocation list (server#63369)

fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63377)

fixFix: allow file request upload when `part_file_in_storage=false` (server#63380)

fixFix: Public link with multiple mounts (server#63383)

fixFix(preview): keep the local file when losing the insert race (server#63391)

fixFix(files_sharing): Use share password policy for password generation (server#63396)

fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63405)

fixFix(files_reminder): passed reminder handling (server#63424)

fixFix(files_external): set usePresignedUrl before first S3 connection (server#63457)

securityMaster] fix(security): Update code signing revocation list (server#63520)

fixFix(preview): execute PreviewMapper::deleteAll() (server#63522)

fixFix(files): hide download action in link shares for newly created folders (server#63553)

fixFix(appconfig): make type-conflict error self-explanatory (server#63642)

fixFix(dav): scope contact photo export to local address books (server#63644)

fixFix cancelling the customization of a share (server#63657)

fixFix(dav): correctly mask public v1 links for non-home storages (server#63667)

fixFix(dav): only derive the write size from a PUT Content-Length (server#63677)

fixFix(settings): Fix AI regex (server#63692)

fixFix: Check that password matches in occ user:auth-tokens:add (server#63696)

fixFix(contactsmenu): restore avatars for non-user contacts (server#63716)

fixFix: Check rememberme cookie previous session id matches uid (server#63720)

fixFix(2fa): Add missing BruteForceProtection attribute (server#63733)

fixFix(core): accept deprecated IANA timezone aliases (server#63757)

fixFix(group): pass previous display name in GroupChangedEvent (server#63780)

fixFix(files_external): guard optional S3 key in storage id computation (server#63818)

fixFix(webauthn): Throw on uid mismatch when updating registration (server#63833)

fixFix: Correctly filter users when the backend does not implement ISearchKnownUsersBackend (server#63842)

fixFix: Ensure we don’t get share by empty name (server#63851)

securityMaster] fix(security): Update code signing revocation list (server#64098)

featureAdd a vitest harness for the front-end (files_pdfviewer#1566)

+40 more items in the release notes

33.0.8 Aug 13, 2026 Release notes ↗

fixFix(files_sharing): preserve unmasked permissions as scan_permissions (server#62217)

featurePerf: Replace more calls from getUserGroups to getUserGroupIds (server#62222)

fixFix: Output shape validation will delete keys when there is a list of files (server#62238)

fixFix(files_external/SMB): Use ‘null’ explicitly for no workgroup (server#62280)

fixFix(files): properly handle folders without permissions (server#62319)

fixFix(files): preserve encryptedVersion when copying cache entries (server#62338)

fixFix(files_version): mtime confusion on milliseconds (server#62371)

fixFix(files_sharing): Use share id in file actions (server#62402)

fixFix(AmazonS3): pass S3 error messages through to the frontend (server#62419)

fixFix(SetupChecks): Link to task processing worker docs (server#62442)

fixFix: Don’t add empty and broken ExternalShareScanJob on upgrade (server#62452)

fixFix(background-jobs): preserve Snowflake IDs as strings (server#62456)

fixFix: harden object store against copying a file to itself (server#62462)

featurePerf(preview): Optimize retriving all previews from oc_filecache (server#62603)

fixFix(unified-search): catch errors in response (server#62614)

securityMaster] fix(security): Update code signing revocation list (server#62653)

fixFix(search): Add end date for last 7 and last 30 days (server#62684)

fixFix(caldav): Expand recurring events for principal calendar search (server#62692)

fixFix(MemcachedFactory): Enable TCP_NODELAY and adjust default timeouts to be reasonable (server#62703)

fixFix(imip): add context to imip log messages (server#62721)

fixFix(share-api-controller): add sanity check on canAccessShare for circle share types (server#62732)

featurePerf(user-display-name): Check memory cache before trying redis (server#62777)

fixFix(encryption): Correctly report size for zero-byte encrypted files (server#62779)

fixFix(provisioning_api): read newUser.sendEmail as a boolean (server#62785)

fixFix(encryption): handle decryption exception with outdated passwords (server#62787)

fixFix(imip): don’t report success when a calendar cannot process iMip (server#62793)

fixFix(systemTags): setObjectIdsForTag() dispatches once (server#62800)

fixFix: handle sftp private key as password (server#62823)

fixFix: disable direct link if link shares are disabled (server#62831)

fixFix: clear key password after loading key (server#62849)

fixFix(direct editing): cleanup tokens on user deletion (server#62863)

fixFix(dav): properly finalize with MOVE only (server#62875)

fixFix(share): do not re-accept rejected shares (server#62890)

fixFix: throw better error message if a user doesn’t have a key even though it should have (server#62892)

featureFeat: Add setting to bypass password confirmation on a selected ip ranges (server#62907)

featureFeat: Allow to check user existence outside specific user backends (server#62916)

featureFeat(lookup): search for local account only via lookupserver (server#62935)

featureFeat: allow specifying applicable users and groups in the files_external:create command (server#62948)

featureFeat(federation): Add accept/decline mechanism for federated calendars (server#63115)

featureFeat: adding an option to exclude users from the acitivity log (activity#2809)

+62 more items in the release notes

33.0.7 Jul 23, 2026 Release notes ↗

fixFix(files_sharing): Drop trailing ‘?’ from public download redirect URL (server#59885)

fixFix(settings): sort app list by app name instead of app objects (server#59992)

fixFix(cypress): disable unsupported-browser redirect in test container (server#60805)

fixFix(core): public share download icon color and theme filter scope (server#61210)

fixFix: update cached mounts when moving share in repair step (server#61499)

fixFix(files_sharing): remove filename’s leading slash on unshare toast (server#61527)

featurePerf: block more properties from using the custom properties backend (server#61541)

fixFix(settings): correct heading order in account management sidebar (server#61547)

fixFix: Make the IProvideUserSecretBackend usable (server#61549)

featurePerf(log): normalize log data only when logging (server#61556)

fixFix(Collaborators): Fix matching emails to remote users if no remote results are present (server#61570)

fixFix(dav): Handle GenericFileException when reading default contact file (server#61595)

fixFix(a11y): label account QR code button (server#61603)

fixFix(files): Open the sidebar for the current folder, not a stale child (server#61605)

fixFix(user_status): stabilise the user_status (server#61619)

fixFix(dav): Load ProfilerPlugin only when profiler is enabled (server#61644)

fixFix(config): Decrypt sensitive appconfigs when requested (server#61661)

fixFix(files_external): ignore deprecated backends (server#61692)

fixFix(files_external): properly apply default mount options (server#61701)

fixFix(settings): in absence form avoid shifting dates to browsers timezone (server#61711)

featurePerf: Only sort wrappers when adding them (server#61718)

featurePerf: Don’t fetch full group object in AuthorizedGroupMapper (server#61851)

featureFeat: Disable callable serialization in sabre/xml (server#61924)

featureFeat: Fetch groups in batch in getUserGroups (server#61935)

featureFeat(login): clean remember me tokens (server#61971)

securityMaster] fix(security): Update code signing revocation list (server#62041)

securityMaster] fix(security): Update code signing revocation list (server#62047)

featurePerf(carddav): reduce disk usage of photocache (server#62053)

featurePerf(workflow): Implement result cache for IP checks (server#62056)

featurePerf: Don’t fetch all the trash items when deleting a single item (server#62179)

securityMaster] fix(security): Update code signing revocation list (server#62185)

featureFeat(files_sharing): schedule external share scan job when accepted (server#62198)

featurePerf(dav): Stream PROPFIND output (server#62225)

securityMaster] fix(security): Update CA certificate bundle (server#62436)

featureFeat: Disable callable serialization in sabre/xml (3rdparty#2512)

featureFeat: make amount of items sent on email configurable via occ (activity#2709)

featurePerf(files): compute move/rename activity settings once (activity#2795)

featureFeat: add release relay gh workflow (app_api#923)

featureFeat: Show request time to the push proxy (notifications#3155)

featureFeat: Add login output when password policy fails (password_policy#967)

+249 more items in the release notes

33.0.6 Jun 25, 2026 Release notes ↗

fixDav: Fix fatal error when ORGANIZER is missing in CalDAV schedule (server#59350)

fixFix(files,files_sharing): swallow redirected navigation errors (server#59887)

fixFix(caldav): grant sharee Acls to the delegate (server#60646)

fixFix(http): avoid iconv for header ascii fallback (server#60722)

fixFix(DB): Enforce foreign key constraints in SQLite (server#60792)

fixFix(encryption): recovery keys should be shown when user keys are used (server#60799)

fixFix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration (server#60819)

fixFix(files): Chromium-based browsers drag-and-drop (server#60899)

fixFix: actually register listener for updating stored external storage credentials (server#60905)

fixFix(MailPlugin): Stop applying the offset twice and the limit per wide/exact (server#60920)

fixFix(sharing): set STATUS_ACCEPTED when creating USERGROUP subshare on… (server#60925)

fixFix(Share): Add missing optional parameter to IManager::shareApiAllowLinks() (server#60928)

fixFix(psalm): Update psalm baseline (server#60933)

fixFix(Storage): use `proxyexclude` parameter in DAV client (server#60939)

fixFix(files_sharing): clear the password after saving (server#60951)

fixFix(files): show proper information when a move will override the target (server#60962)

fixFix: access shared and delegated trashbin objects (server#60967)

fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60984)

securityMaster] fix(security): Update code signing revocation list (server#61002)

fixFix(dav): finalize upload metadata before post-write hooks (server#61070)

fixFix(dav): properly handle files metadata (server#61079)

fixFix(comments): Use capped memory cache for comments (server#61096)

securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104)

fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61107)

fixFix: Correctly detect appid for dist css files (server#61112)

fixFix: use correct permissions mask for non-home storage public links (server#61117)

fixFix(settings): Show loading spinner while searching accounts (server#61121)

securityMaster] fix(security): Update code signing revocation list (server#61134)

featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61156)

fixFix(previews): ffprobe hangs (server#61183)

fixFix(files_versions): guard null path in event listeners (server#61188)

fixFix(SetupChecks): maintenance window length is 4h (not 6h) (server#61192)

fixFix(search-query): fix psalm type error (server#61196)

securityMaster] fix(security): Update code signing revocation list (server#61238)

fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61242)

securityMaster] fix(security): Update code signing revocation list (server#61284)

featureFeat(oauth2): Add commands for adding and deleting clients (server#61362)

securityMaster] fix(security): Update code signing revocation list (server#61430)

featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2637)

featureFeat: Add role-based filtering for circle member queries (circles#2504)

+48 more items in the release notes

33.0.5 Jun 2, 2026 Release notes ↗

otherRefactor: move release changelog workflow to releases repo (server#60831)

fixFix: Add missing DI for IAppConfig to Push.php (notifications#3039)

fixFix(folderDescription): always use ‘Readme.md’ as filename (text#8658)

fixFix(headings): skip headings in details in table of contents (text#8660)

otherTest(playwright): add summary job so we can add it to merge rules (text#8663)

33.0.4 May 28, 2026 Release notes ↗

fixFix: allow renaming files with just update permissions (server#59241)

fixFix(encryption): limit oprhaned keys scan to one user (server#59808)

fixFix(s3): ignore prefixes with repeating delimiters (server#59829)

fixFix removed address book items not being synced between federated instances (server#59894)

fixFix(files): fix custom client-side error messages on move/copy actions (server#59954)

featureFeat: Better reporting if something is wrong with taskprocessing (server#59991)

fixFix: Harmonize login and passwordless login redirect behavior (server#60007)

fixFix(core): provide valid initial state also on public templates (server#60015)

fixFix(navigation): Fix default app icon (server#60133)

fixFix(files): escape html entities in dav search requests (server#60140)

fixFix(LocalPreviewStorage): Use correct regex to detect files in nested directory format (server#60143)

fixFix(comments): register event listener for typed comment events (server#60149)

fixFix(core): use btoa() instead of window.Buffer.from() for base64 encoding (server#60157)

fixFix: Dispatch old comment events (server#60168)

fixFix(comments): Add an action to comment notification that dismisses it (server#60175)

fixFix(core): prompt for password once when installing recommended apps (server#60184)

featureFeat(updatenotification): handle files_lock (server#60203)

fixFix(public.scss): increase footer width (server#60208)

fixFix: correct typo ‘occured’ to ‘occurred’ in SetupCheckManager (server#60210)

fixFix since checker (server#60219)

fixFix(settings): Fix admin delegation for hidden sections (server#60222)

fixFix: Fix permission issue when uploading a chunked file (server#60240)

featureFeat(app-licenses): Add further compatible licenses for apps to use (server#60296)

fixFix(Setup): Ensure instanceid is generated during installation (server#60301)

fixFix(http-client): detect brotli support via libcurl, not PHP extension (server#60309)

fixFix(s3): Add Content-MD5 header for DeleteObjects to fix AWS SDK v3.339.0+ compatibility (server#60322)

fixFix(snowflake): fix wrong documentation about serverId (server#60328)

featurePerf(share): Remove useless order by id (server#60345)

breakingRemove unneeded sort when listing mail/federated shares (server#60356)

featurePerf: remove unneeded sort in getFolderContentsById (server#60357)

securityFix(security): Update Expires time (server#60396)

featureFeat(users): Check assertion when enabling user (server#60516)

featureEnh(occ): make it possible to add an arbitrary number of users to a g… (server#60601)

featureFeat(openmetrics): export more resilient if exception happens (server#60627)

featureFeat: add search and limit support for team members list (circles#2460)

featureFeat: Remove unnecessary whitespaces (logreader#2027)

featureFeat(push): Optionally use OAEP padding (notifications#2986)

featurePerf(rich_workspace): only add property for parent (text#8498)

featureFeat: add support for wiki-style link and image Markdown syntax (text#8576)

securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580)

+86 more items in the release notes

33.0.3 Apr 30, 2026 Release notes ↗

securityFixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…

securityFixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…

securityFixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…

securityFixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…

securityFixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…

featureFeat(migration-attributes): add DataCleansing (server#54861)

featureFeat(SystemTag): Add typed events for tag mapper events (server#54863)

securityFix(security): Update Expires time (server#54868)

featureAdd task processing manager method to get the list of available task type IDs (server#54917)

featureFeat(file_sharing): Provide template creator list in public shares (server#54948)

featureFeat: show object store instance in info:file (server#54961)

featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#54967)

featurePerf(mounts): avoid array_merge in mounts loop (server#54976)

securityFix(security): Update CA certificate bundle (server#54982)

featureFeat(ZipFolderPlugin): always use the parent folder name as archive name (server#55020)

securityFix(security): Update code signing revocation list (server#55051)

featureFeat(encryption): Add integration tests for occ commands and fix them (server#55060)

featureFeat(files_sharing): provide web components based API for sidebar (server#55174)

featureFeat(db): add SSL/TLS support for PostgreSQL (server#55256)

featureFeat(Unified search): Use existing min search length setting (server#55301)

featureFeat: Mark OC.SystemTags as deprecated (server#55323)

featureAdmin-delegation occ – add output option for show command to support JSON formats (server#55430)

securityFix(security): Update code signing revocation list (server#55445)

featureFeat: add header with user id in response (server#55502)

featureAllow to remove a website in the user profile (server#55523)

featureFeat(test-case): allow to use PHPUnit Group attributes to mark tests requiring database (server#55571)

featureFeat(settings): Introduce TaskProcessingSuccessRate setup check (server#55778)

featureFeat: add new link endpoint when using globalscale (server#55798)

featureFeat(route): globalsiteselector as root url generator (server#55817)

featureFeat: locally cache frequently requested LDAP mapping data (server#55823)

featureAdd font-variant-numeric to selected files list (server#55873)

featureAdd unit tests for AdminDelegation command and AuthorizedGroupService (server#56044)

securityFix(security): Update CA certificate bundle (server#56209)

featureFeat(EphemeralSessions): Introduce lax period (server#56232)

featureFeat(cloud-federation-api): accept folder shares (server#56336)

featureFeat: add occ command to scan and delete orphaned keys (server#56347)

securityFix(security): Update code signing revocation list (server#56365)

featureAdd AI input limits (server#56369)

featureFeat(rate-limit): Allow overwriting the rate limit (server#56382)

featureAdd rememberme checkbox (server#56423)

+732 more items in the release notes

33.0.2 Apr 2, 2026 Release notes ↗

otherserver

featureFeat(recent-files): add recent_files_limit config on files settings (server#59216)

other33.0.2 RC0 (server#59259)

fixFix(files_sharing): do not prevent share creation if password is enabled but not supported by the current share type (server#59263)

fixFix(sharing): Don’t redirect when accepting a share failed (server#59305)

other33.0.2 RC1 (server#59306)

other33.0.2 (server#59392)

otheractivity

otherChore(branchoff): Set version on stable33 to a stable one (activity#2480)

otherbruteforcesettings

otherChore(branchoff): Set version on stable33 to a stable one (bruteforcesettings#1032)

otherUpdate nextcloud/ocp dependency (bruteforcesettings#1038)

otherfiles_downloadlimit

otherChore(branchoff): Set version on stable33 to a stable one (files_downloadlimit#756)

otherfiles_pdfviewer

otherChore(branchoff): Set version on stable33 to a stable one (files_pdfviewer#1401)

otherfirstrunwizard

otherChore(branchoff): Set version on stable33 to a stable one (firstrunwizard#2020)

otherpassword_policy

otherChore(branchoff): Set version on stable33 to a stable one (password_policy#914)

otherphotos

otherChore(branchoff): Set version on stable33 to a stable one (photos#3459)

otherprivacy

otherChore(branchoff): Set version on stable33 to a stable one (privacy#1289)

otherrecommendations

otherChore(branchoff): Set version on stable33 to a stable one (recommendations#1004)

otherrelated_resources

otherChore(branchoff): Set version on stable33 to a stable one (related_resources#907)

otherserverinfo

otherChore(branchoff): Set version on stable33 to a stable one (serverinfo#967)

othersurvey_client

otherChore(branchoff): Set version on stable33 to a stable one (survey_client#391)

othersuspicious_login

otherChore(branchoff): Set version on stable33 to a stable one (suspicious_login#1092)

othertext

fixFix(deps): update dependency yjs to ^13.6.30 (text#8394)

otherChore(branchoff): Set version on stable33 to a stable one (text#8407)

othertwofactor_totp

otherChore(branchoff): Set version on stable33 to a stable one (twofactor_totp#1751)

fixFix(deps): align composer-lock and checked-in vendor/ (updater#727)

+3 more items in the release notes

33.0.1 Mar 26, 2026 Release notes ↗

securityFixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the…

fixFix(docs): Fix dead documentation link for Windows file names (server#58291)

fixFix(comments): properly handle opening the sidebar when Activity integration is used (server#58294)

fixFix(theming): display error messages on image upload and delete previous image only after validation (server#58323)

fixFix: don’t try to create preview folder if it already exists (server#58328)

fixFix: obey x-nc-scheduling flag on delete (server#58341)

fixFix(sftp): Handle empty port parameter to allow host-defined ports (server#58358)

featureFeat: add upload_time support to file search and recent files (server#58374)

fixFix(files): correctly sort views (server#58375)

fixFix(cache): filter out invalid entries in `OC\Files\Cache\Wrapper\CacheWrapper::getFolderContentsById` (server#58378)

fixFix(setup): add index properties_name_path_user by default on new installs (server#58418)

fixFix(external_storage): hide local storage as an option for users (server#58424)

fixFix(user_status): mount emoji picker outside of dialog (server#58429)

fixFix(perf): use index when deleting old previews (server#58431)

fixFix(Propagator): Skip groupfolders root entries (server#58433)

fixFix/more missing userid cases (server#58440)

fixFix(files_sharing): ensure the server share API errors are shown (server#58441)

fixFix(TransferOwnershipService): Remove groupfolders size (server#58449)

fixFix(Propagator): Also skip groupfolders versions and trash entries (server#58450)

fixFix(View): Handle ICacheEntry returned by FileInfo->getData() (server#58455)

fixFix(files): fix tab navigation from select all checkbox to batch actions (server#58462)

fixFix(files_sharing): make legacy `downloadShare` endpoint compatible with legacy behavior (server#58468)

fixFix(dav): Use an exhaustive list for allowed serialized classes (server#58511)

featureFeat: calendar read and write federation (server#58590)

featurePerf(sharing): Avoid loading all shares from all users when unsharing (server#58658)

featureFeat: set creation_time on file creation and render recently created icon (server#58694)

breakingRemove external shares from share list (server#58717)

featurePerf(preview): bulk process preview regeneration (server#58796)

featureFeat: Add memcache_customprefix (server#58810)

featureFeat(routing): add files_sharing_raw to rootUrlApps (server#58838)

securityFix(SecurityMiddleware): return header to distinguish error type (server#58880)

featureFeat: improve calendar migrator (server#58907)

featureFeat(CalDAV): Add function to get the token of a publicly shared calendar (server#59080)

featureFeat(taskprocessing): add worker command for synchronous task processing (server#59082)

featurePerf: Replace getById call with getFirstNodeById (activity#2388)

featurePerf: add new index to serve a full WHERE clause (activity#2447)

featureFeat: make Docker API version configurable via app config (app_api#798)

featureAvoid cropping logo in About & New slideshow (firstrunwizard#1964)

featureFeat(api): Add context parameter to generate and validate endpoints (password_policy#900)

deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1268)

+137 more items in the release notes

33.0.0 Feb 18, 2026 Release notes ↗

featureAdd UserConfigChangedEvent to fire whenever a user config value is changed (server#42039)

featureFeat: Add appconfig to disable fixed userfolder permissions optimization (server#51145)

featureFeat: add an option to filter what paths get checked for updates (server#52442)

featureFeat(CertificateManager): Add option to specify the default certificates bundle path (server#52749)

featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#52825)

featureFeat(previews): allow ffmpeg to connect direct for AWS S3 buckets (server#53634)

featureFeat(login): hide password on form submit (server#53869)

featureFeat(previews): previews for large remote files without full file download (server#53952)

featureFeat(encryption): Add integration tests for occ commands and fix them (server#54316)

featureFeat: locally cache frequently requested LDAP mapping data (server#54429)

featurePerf(s3): Provide direct pre-signed download link (server#54436)

featureAdd INodeByPath to Directory (server#54441)

featureFeat(config): Add common audio and video MIME type aliases (server#54447)

featurePerf(preview): Split preview data to new table (server#54543)

featureFeat(file_sharing): Provide template creator list in public shares (server#54565)

featureFeat(comments): add Markdown support (server#54685)

featureFeat(files_sharing): provide web components based API for sidebar (server#54788)

featureFeat(ObjectStore): Add option to limit the total size (server#54797)

featureFeat(SystemTag): Add typed events for tag mapper events (server#54810)

featureFeat(migration-attributes): add DataCleansing (server#54842)

featureFeat(migration-attributes): missing attributes (server#54846)

featureAdd task processing manager method to get the list of available task type IDs (server#54848)

security[master] fix(security): Update CA certificate bundle (server#54992)

security[master] fix(security): Update code signing revocation list (server#55056)

security[master] fix(security): Update code signing revocation list (server#55446)

deprecatedPort away from deprecated Doctrine APIs (server#55674)

breakingChore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718)

breakingRemove stable30 from dependabot (server#56018)

security[master] fix(security): Update CA certificate bundle (server#56211)

security[master] fix(security): Update code signing revocation list (server#56363)

breakingDebt(files): Remove regular stats request (server#56792)

security[master] fix(security): Update CA certificate bundle (server#56811)

security[master] fix(security): Update code signing revocation list (server#57031)

breakingEnhancement(files): remove redundant success toast on file rename (server#57168)

security[master] fix(security): Update code signing revocation list (server#57262)

breakingRefactor!: migrate files sidebar to Node API (server#57277)

security[master] fix(security): Update code signing revocation list (server#57380)

securityFix(security): Update Expires time (server#57688)

securityFix(security): Update code signing revocation list (server#57948)

deprecatedCleanup unused code and deprecated imports (text#7752)

+2364 more items in the release notes

32.0.15 Sep 10, 2026 Release notes ↗

32.0.14 Aug 13, 2026 Release notes ↗

32.0.13 Jul 23, 2026 Release notes ↗

32.0.12 Jun 25, 2026 Release notes ↗

32.0.11 Jun 2, 2026 Release notes ↗

32.0.10 May 28, 2026 Release notes ↗

32.0.9 Apr 30, 2026 Release notes ↗

32.0.8 Apr 2, 2026 Release notes ↗

32.0.7 Mar 26, 2026 Release notes ↗

32.0.6 Feb 12, 2026 Release notes ↗

32.0.5 Jan 16, 2026 Release notes ↗

32.0.4 Jan 15, 2026 Release notes ↗

securityFixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…

32.0.3 Dec 11, 2025 Release notes ↗

securityFixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…

securityFixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…

32.0.2 Nov 20, 2025 Release notes ↗

32.0.1 Oct 23, 2025 Release notes ↗

securityFixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…

securityFixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont…

32.0.0 Sep 27, 2025 Release notes ↗

31.0.14 Feb 12, 2026 Release notes ↗

31.0.13 Jan 15, 2026 Release notes ↗

31.0.12 Dec 11, 2025 Release notes ↗

31.0.11 Nov 20, 2025 Release notes ↗

31.0.10 Oct 23, 2025 Release notes ↗

31.0.9 Sep 11, 2025 Release notes ↗

31.0.8 Aug 14, 2025 Release notes ↗

31.0.7 Jul 10, 2025 Release notes ↗

31.0.6 Jun 12, 2025 Release notes ↗

31.0.5 May 15, 2025 Release notes ↗

featureFeat: add logging to preview generation (server#52300)

featureFeat: handle hide-download DAV property (viewer#2807)

featureFeat: lowercase headers to exclude in exapp proxy (app_api#569)

featureFeat(profile): Add an API to get the profile field data (server#52372)

featureFeat(security): add configurable IPv6 subnet for BFP and throttling (server#52233)

fixFix multiple cypress issues (activity#1994)

fixFix saving annotations in paths with special characters (files_pdfviewer#1194)

fixFix task processing registration validation (app_api#573)

fixFix: Adjust padding in table cell and header components (text#7189)

fixFix: adjust webpack nonce generation (server#52003)

fixFix: Apply storage checks in addition to share (text#7192)

fixFix: Check that user actually can validate password for js (server#52237)

fixFix: don't check node access again for listing reminders in dav (server#52504)

fixFix: don't setup the filesystem to check if a user is blocked by ACLs (activity#1985)

fixFix: exclude vendor-bin from release artifacts (suspicious_login#989)

fixFix: fix preloading files with no custom properties (server#52101)

fixFix: Flaky samba kerberos tests (server#52578)

fixFix: Forward attributes to the sidebar (server#52566)

fixFix: Open PDF file in "richdocuments" if it is not downloadable (files_pdfviewer#1204)

fixFix: Proper order for checking path prefix for getting file by id from cache (server#52039)

fixFix: submit button on file picker dialog (text#7190)

fixFix: Transfer ownership with S3 as primary (server#52185)

fixFix: try to avoid memory exhaustion (suspicious_login#988)

fixFix(apps): Sort names separately from active/update state (server#52653)

fixFix(blurhash): Use preview API to generate the previews (server#52661)

fixFix(build): avoid double load of the app (notifications#2309)

fixFix(CalDAV): do not ignore move command object target uri (server#52562)

fixFix(CI): disable RateLimiting for Nextcloud in the CI (app_api#565)

fixFix(config): Censor more app configs in system report (server#52433)

fixFix(dav): allow uploading of files with long filenames (server#52302)

fixFix(dav): check the owner displayName scope before giving attribute (server#52554)

fixFix(db): Create replacement index where original index is missing (server#52394)

fixFix(exAppMapper): init missing headers_to_exclude (app_api#564)

featurePerf: Log requests using high amount of memory as warning (server#52219)

featurePerf(caldav): increase chunk size in RemoveOrphanEventsAndContacts repair step (server#52548)

featurePerf(cloud_federation_api): only provide capabilities if needed (server#52030)

featurePerf(db): Extend index on cards_properties to cover name and value (server#52415)

featurePerf(files_reminders): Reduce db queries on propfind (server#51736)

featurePerf(files_sharing): do not emit second propfind for account filter (server#52001)

breakingRemove custom handling for public share pages with single files (files_pdfviewer#1206)

+51 more items in the release notes

31.0.4 Apr 17, 2025 Release notes ↗

other[stable31] fix(taskprocessing): use the event for AppAPI to get list of AI providers

other[stable31] fix(dav): Really only run the chunk cleanup once

fix[stable31] fix(files_sharing): fix share creation error handling

fix[stable31] feat(bulk-upload): change the default to disabled as there are still some bugs present

other[stable31] fix(federation): Don't load the addressbook when resolving a cloud ID

other[stable31] ignore missing theming app

other[stable31] fix(ContextAgent): Do not translate the name ContextAgent

otherbuild(deps): bump marked from 15.0.7 to 15.0.8

feature[stable31] chore(files_trashbin): Add user details in log from Trashbin

other[stable31] fix: Handle missing share providers when promoting reshares

otherbuild(deps): bump @nextcloud/event-bus from 3.3.1 to 3.3.2

otherbuild(deps): bump dompurify from 3.2.4 to 3.2.5

other[stable31] fix(files_sharing): rate limit share creation 20 times per 10 minutes

other[stable31] fix(files_sharing): Apply default password setting in SharingDetailsTab

other31.0.4 RC1

other31.0.4

31.0.3 Apr 11, 2025 Release notes ↗

securityFixes CVE-2025-47790: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3…

fixFix(files): also show file list headers on empty views (server#51275)

fixFix(dav): Create SAB at installation (server#51316)

fixFix: remote account activity translation (server#51326)

fixFix: Do not build encrypted password if there is none (server#51330)

featureFeat(dav): add webhook compatibility for calendar object events (server#51331)

fixFix disabled user list for SAML group subadmin (server#51376)

fixFix(files_external): Stop building path twice when checking if file exists on case insensitive SMB storage (server#51388)

fixFix(CalDav): alter invitation attachment filename and type (server#51466)

fixFix(files_sharing): ensure share status action works also in grid view (server#51474)

fixFix(profile): allow to unset phone number (server#51511)

fixFix: skip caching lastSeenQuotaUsage for remote shares (server#51522)

fixFix(cardav): only show users from enabled addressBooks in contacts menu (server#51539)

fixFix(unified-search): do not overlap search bar with button (server#51566)

fixFix(webauthn): adjust for updated library and add tests (server#51578)

fixFix: pass hide download attribute while creating the share to fix github issue 50788 (server#51582)

fixFix(files_sharing): skip expiration notify for invalid share record (server#51616)

fixFix(ocm): publicKey can be disabled so capabilities do not match (server#51653)

fixFix(files): Ensure actions never overflow filename (server#51659)

fixFix(IFilenameValidator): correctly handle case insensitivity (server#51662)

fixFix(user): Some strings not being translated (server#51666)

fixFix(provisioning_api): Pass on translated hint if password change fails (server#51672)

fixFix(setupchecks): Treat information messages as success (server#51678)

fixFix(database): Cast users count to integer (server#51688)

fixFix(systemtags): Dispatch events when bulk assigning system tags (server#51690)

featurePerf(sharing): Use oc_share.item_type IN instead of OR equals (server#51691)

fixFix(dav): filter user files when updating tags (server#51693)

fixFix files_sorting cypress tests (server#51695)

fixFix(login): Improve CSRF error message for better user understanding (server#51699)

fixFix public download activity (server#51704)

fixFix: filter out contacts with empty email addresses in sharee completion (server#51708)

fixFix(GenerateBlurhashMetadata): Suppress imagescale errors (server#51718)

fixFix(occ): Suppress errors when checking config.php fileowner (server#51720)

fixFix(files_versions): correctly show version author also for shared files (server#51723)

fixFix(files_reminders): Fix reminder actions being displayed on invalid nodes (server#51738)

featureFeat: Limit ExpireTrash job to 30 minutes (server#51808)

featurePerf(cron): Delay (re)checking timed jobs (server#51820)

featureRevert "refactor: add migration for email setting" (server#51987)

featureFeat(ip): use larger IPv6 range by default (server#52033)

featureFeat: skip expire sharing notify if node deleted (activity#1937)

+57 more items in the release notes

31.0.2 Mar 19, 2025 Release notes ↗

other[stable31] fix(mime-types): adjust compiled mime types and sign

other[stable31] fix(encryption): Listen for user login and logout to set encryption key

feature[stable31] Allow to delete files without trashbin + add unit tests + some refactoring

fix[stable31] fix(dav): Fix share token pattern for base uri extraction

other[stable31] fix(RichObjectStrings): Make exception messages for invalid parameters more useful for debugging

breaking[stable31] test: Remove .only() calls

other[stable31] ci: Update 3rdparty actions

fix[stable31] fix(comments): Fix activity rich subject parameters

other[stable31] fix(base.php): Correct order for booting \OC\Server

other[stable31] fix(files): Make sure file pointer exists

feature[stable31] fix(auth): Allow 2FA challenges for Ephemeral sessions

other31.0.2 RC1

other31.0.2

31.0.1 Mar 13, 2025 Release notes ↗

securityFixes CVE-2025-66547: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via…

securityFixes CVE-2025-66552: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app t…

securityFixes CVE-2025-47794: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13…

other[stable31] ci(autochecks): Run some autochecks also on non-PHP files

other[stable31] fix(cron): Ignore time sensitivity when a class was explicitely scheduled

other[stable31] fix: Initialize lastConnectionCheck after first connection

other[stable31] fix(files_versions): Do not expire versions newer than min age

other[stable31] fix: wipe local storages on log out

other[stable31] fix: Change UserAgent to *cloud

other[stable31] Fix: NotFoundException for anonymous users

other[stable31] Spelling standardization

fix[stable31] fix(admin_audit): Fix incorrect truncation of files path in admin audit log

other[stable31] chore(deps-dev): bump ts-loader from 9.5.1 to 9.5.2

security[stable31] fix(security): Update CA certificate bundle

other[stable31] fix(systemtags): Use literal strings for i18n in showSuccess

other[stable31] feat: support migrating an instance to sharding

other[stable31] fix: Report duplicated extra files in integrity check

fix[stable31] fix(translation): Fix string concatenation in LDAP endpoint

fix[stable31] files: fix exception when share-attributes is undefined

other[stable31] fix(l10n): Improve english source strings

other[stable31] make it possible to run occ as root

other[stable31] fix(cypress): wait for toast to appear

other[stable31] fix(dav): Handle end of stream in File::put

otherchore(deps-dev): bump @nextcloud/eslint-config from 8.4.1 to 8.4.2

otherchore(deps): bump @nextcloud/files from 3.10.1 to 3.10.2

otherchore(deps): bump marked from 15.0.6 to 15.0.7

securityFix A+ rating when checking with Nextcloud Security Scan.

otherchore(deps): bump focus-trap from 7.6.0 to 7.6.4

otherchore(deps-dev): bump @types/dockerode from 3.3.34 to 3.3.35

other[stable31] fix(files_reminders): Do not attempt to send reminders after a user has left a share

other[stable31] Remove space

other[stable31] chore(deps): bump webdav from 5.7.1 to 5.8.0

breaking[stable31] fix: remove caching in fetchListOfGroups

other[stable31] feat: Close sessions created for login flow v2

other[stable31] fix(files_external): Move definition parameter to the correct place

other[stable31] fix(files): Ensure the filter instance is mounted

other[stable31] fix(files_trashbin): disable bulk download for trashbin

feature[stable31] refactor(TempManager): Simplify and unify implementations and remove legacy behavior

feature[stable31] feat: Add bases and gidNumber attribute to ldap:test-user-settings output

feature[stable31] feat(files): allow to ignore warning to change file type

+29 more items in the release notes

31.0.0 Feb 25, 2025 Release notes ↗

other[stable31] fix: validate account properties as a repair step

other31.0.0

30.0.17 Oct 23, 2025 Release notes ↗

30.0.16 Sep 25, 2025 Release notes ↗

30.0.15 Sep 11, 2025 Release notes ↗

30.0.14 Aug 14, 2025 Release notes ↗

30.0.13 Jul 10, 2025 Release notes ↗

30.0.12 Jun 12, 2025 Release notes ↗

30.0.11 May 15, 2025 Release notes ↗

featureFeat: lowercase headers to exclude in exapp proxy (app_api#570)

featureFeat(admin_audit): write admin audit log for login failed (server#51107)

featureFeat(security): add configurable IPv6 subnet for BFP and throttling (server#52232)

fixFix saving annotations in paths with special characters (files_pdfviewer#1193)

fixFix task processing registration validation (app_api#574)

fixFix: Adjust padding in table cell and header components (text#7187)

fixFix: Apply storage checks in addition to share (text#7193)

fixFix: Check that user actually can validate password for js (server#52238)

fixFix: don't setup the filesystem to check if a user is blocked by ACLs (activity#1986)

fixFix: exclude vendor-bin from release artifacts (suspicious_login#990)

fixFix: Fix copying to the root of another mountpoint (server#52499)

fixFix: fix preloading files with no custom properties (server#52102)

fixFix: Flaky samba kerberos tests (server#52580)

fixFix: Open PDF file in "richdocuments" if it is not downloadable (files_pdfviewer#1205)

fixFix: Transfer ownership with S3 as primary (server#52184)

fixFix: try to avoid memory exhaustion (suspicious_login#987)

fixFix(apps): Sort names separately from active/update state (server#52652)

fixFix(blurhash): Use preview API to generate the previews (server#52660)

fixFix(build): avoid double load of the app (notifications#2308)

fixFix(CalDAV): do not ignore move command object target uri (server#52561)

fixFix(CI): disable RateLimiting for Nextcloud in the CI (app_api#566)

fixFix(config): Censor more app configs in system report (server#52432)

fixFix(dav): allow uploading of files with long filenames (server#52377)

fixFix(dav): check the owner displayName scope before giving attribute (server#52553)

fixFix(db): Create replacement index where original index is missing (server#52393)

fixFix(deps): Bump symfony/process (twofactor_totp#1582)

fixFix(exAppMapper): init missing headers_to_exclude (app_api#563)

fixFix(federation): allows equal signs in federation id (server#52386)

fixFix(files_external): Mark password fields for LoginCredentials and SessionCredentials as hidden and optional (server#52645)

fixFix(files_sharing): file request pass empty string if password or expiration is disabled (server#52196)

fixFix(files_sharing): Improve expiration date input change handling (server#52408)

fixFix(files_sharing): Prevent create/delete permissions on file shares (server#52530)

fixFix(files_versions): create version if previous does not exist (server#52412)

fixFix(files): Ensure the filter instance is mounted (server#52557)

fixFix(files): prevent dragging preview when drag-drop (server#52362)

fixFix(info.xml): correct developer docs link (typo) (app_api#559)

fixFix(JSResourceLocator) fix incorrect parameter being used (server#52523)

featurePerf(caldav): increase chunk size in RemoveOrphanEventsAndContacts repair step (server#52547)

featurePerf(db): Extend index on cards_properties to cover name and value (server#52414)

featurePerf(files_sharing): do not emit second propfind for account filter (server#52002)

+24 more items in the release notes

30.0.10 Apr 17, 2025 Release notes ↗

other[stable30] Fix(TaskProcessing): for validation for taskprocessing EShapeType

security[stable30] fix(security): Update code signing revocation list

other[stable30] fix(federation): Don't load the addressbook when resolving a cloud ID

other[stable30] fix(dav): Really only run the chunk cleanup once

fix[stable30] feat(bulk-upload): change the default to disabled as there are still some bugs present

fix[stable30] fix(files_sharing): fix share creation error handling

feature[stable30] chore(files_trashbin): Add user details in log from Trashbin

other[stable30] fix: Handle missing share providers when promoting reshares

other[stable30] fix(tests): Share manager error message from #52076

otherbuild(deps): bump dompurify from 3.2.4 to 3.2.5

other[stable30] ignore missing theming app

other[stable30] fix: Proper order for checking path prefix for getting file by id from cache

other[stable30] fix(files_sharing): rate limit share creation 20 times per 10 minutes

other[stable30] fix(files_sharing): Apply default password setting in SharingDetailsTab

other30.0.10 RC1

other[stable30] fix: only do cache copy in updater if the parent folder should be in cache

other30.0.10

30.0.9 Apr 11, 2025 Release notes ↗

fixFix(dav): Create SAB at installation (server#51315)

fixFix: remote account activity translation (server#51325)

fixFix: Do not build encrypted password if there is none (server#51327)

fixFix disabled user list for SAML group subadmin (server#51375)

fixFix(files_external): Stop building path twice when checking if file exists on case insensitive SMB storage (server#51387)

fixFix(CalDav): alter invitation attachment filename and type (server#51467)

fixFix(files_sharing): ensure share status action works also in grid view (server#51473)

fixFix(profile): allow to unset phone number (server#51510)

fixFix: skip caching lastSeenQuotaUsage for remote shares (server#51523)

fixFix(cardav): only show users from enabled addressBooks in contacts menu (server#51538)

fixFix(unified-search): do not overlap search bar with button (server#51565)

fixFix: skip transfering shares that we can't find (server#51570)

fixFix: pass hide download attribute while creating the share to fix github issue 50788 (server#51581)

fixFix: log which file cannot be opened (server#51584)

fixFix(files_sharing): skip expiration notify for invalid share record (server#51614)

fixFix(files): Ensure actions never overflow filename (server#51658)

fixFix(IFilenameValidator): correctly handle case insensitivity (server#51661)

fixFix(user): Some strings not being translated (server#51665)

fixFix(provisioning_api): Pass on translated hint if password change fails (server#51671)

fixFix(setupchecks): Treat information messages as success (server#51679)

fixFix(admin_audit): Fix incorrect truncation of files path in admin audit log (server#51681)

featurePerf(sharing): Use oc_share.item_type IN instead of OR equals (server#51692)

fixFix(login): Improve CSRF error message for better user understanding (server#51700)

fixFix: filter out contacts with empty email addresses in sharee completion (server#51709)

fixFix(GenerateBlurhashMetadata): Suppress imagescale errors (server#51717)

fixFix(occ): Suppress errors when checking config.php fileowner (server#51719)

fixFix(files_versions): correctly show version author also for shared files (server#51722)

featureAdd occ user:welcome command to send user welcome email from CLI (server#51731)

fixFix(files_reminders): Fix reminder actions being displayed on invalid nodes (server#51739)

fixFix(files_versions): Rely on server mime fallback icons (server#51747)

fixFix(theming): enforce theme also for login (server#51754)

fixFix: task type translations (server#51756)

fixFix: resolve typo in authMethod enum cases (server#51757)

fixFix(cs-fixer): Correctly ignore files ignored by git (server#51775)

fixFix(settings): Fix infinitely loading account management page with pagination of groups (server#51782)

featureFeat: Limit ExpireTrash job to 30 minutes (server#51807)

featureRevert "refactor: add migration for email setting" (server#51986)

featureFeat(ip): use larger IPv6 range by default (server#52032)

+40 more items in the release notes

30.0.8 Mar 19, 2025 Release notes ↗

other[stable30] fix(mime-types): adjust compiled mime types and sign

breaking[stable30] test: Remove .only() calls

other[stable30] ci: Update 3rdparty actions

other[stable30] fix(base.php): Correct order for booting \OC\Server

other[stable30] fix(files): Make sure file pointer exists

other[stable30] fix(files): also show file list headers on empty views

feature[stable30] fix(auth): Allow 2FA challenges for Ephemeral sessions

other30.0.8 RC1

other30.0.8

30.0.7 Mar 13, 2025 Release notes ↗

other[stable30] fix(files): Do not download files with openfile query flag

other[stable30] fix: make sure we process mime extensions as string

other[stable30] fix: don't use cached root info from shared cache if the watcher has detected an update

other[stable30] fix(TaskProcessing\Manager): Always use distributed cache and use PHP serialize

feature[stable30] test: re-add object store primary storage phpunit tests

other[stable30] fix(files): Correctly copy the cache information during copy operations

fix[stable30] Fix incorrect permissions when copying shared files

deprecated[stable30] fix(repair): PHP8.3 deprecation warning

fix[stable30] Bug/48678/restore dav error response

otherchore(deps-dev): bump cypress-split from 1.24.9 to 1.24.11

otherchore(deps): bump @nextcloud/files from 3.10.1 to 3.10.2

fix[stable30] fix: Fix regression in calendar invitation sending

other[stable30] fix(SharedStorage): Check if storage ID is set on cache

other[stable30] fix(login): only show error state on login box if user interacted

feature[stable30] fix(transferownership): Allow searching new owner by email

other[stable30] perf(files): faster query to fetch incomplete directories

other[stable30] fix(files): Properly reset all file list filters on view change

other[stable30] fix(systemtags): do not hide if no tags

fix[stable30] fix(activity): Fix activity parameter types

fix[stable30] fix(files_sharing): Fix public share expiration being set when toggle is not enabled

other[stable30] fix(files): properly forward open params from short urls

other[stable30] fix(cron): Keep job class limitation when searching for the next job

other[stable30] fix(files_sharing): Also list deleted team shares

other[stable30] fix(files_external): request strict password auth on credentials enter action

fix[stable30] fix(l10n): Fix triple dot in translation

other[stable30] fix: Change UserAgent to *cloud

other[stable30] Update @nextcloud/vue to v8.23.1

other[stable30] fix(cypress): opendetails tests

other[stable30] ci(autochecks): Run some autochecks also on non-PHP files

other[stable30] fix(files): handle failed node properly

otherchore(deps): bump libphonenumber-js from 1.11.19 to 1.11.20

other[stable30] fix: validate account properties as a repair step

otherchore(deps-dev): bump @nextcloud/eslint-config from 8.4.1 to 8.4.2

security[stable30] fix(security): Update CA certificate bundle

feature[stable30] refactor(TempManager): Simplify and unify implementations and remove legacy behavior

feature[stable30] fix(test): Add missing data-cy attribute for file actions

fix[stable30] fix(translation): Fix string concatenation in LDAP endpoint

feature[stable30] Add LDAP test settings command

fix[stable30] fix(external_storage): fix settings save

+38 more items in the release notes

30.0.6 Feb 13, 2025 Release notes ↗

other[stable30] fix: template field title

fix[stable30] fix(Mailer): Fix sendmail binary fallback

other30.0.6

30.0.5 Jan 16, 2025 Release notes ↗

fixFix metadata storage with sharding (server#49165)

fixFix(files): virtual scroller item size computation (server#49561)

fixFIX WebDav MacOS failed uploads php-fpm and big files (-36 error) (server#49562)

fixFix(maintenance): Show a success message on data-fingerprint command (server#49591)

fixFix(setupcheck): Make the Memcache setupcheck use the cache (server#49594)

fixFix(files): properly update paths and folder children on node move (server#49610)

fixFix: Add command to update re-share if shared-by user has been revoked (server#49612)

featurePerf: improve performance of SharedStorage::getWatcher (server#49615)

featureAdd an error log message that notifications app isn't enabled at file… (server#49618)

fixFix(external_storage): Cast id to int (server#49624)

fixFix: promote re-shares when deleting the parent share (server#49629)

fixFix: Handle copy of folders containing live photos (server#49650)

fixFix: smb: don't fail hard if we can't load acls for a file (server#49651)

fixFix: don't propagate future mtimes (server#49656)

fixFix(migration): Check if table exists (server#49690)

fixFix(CalDav): add support for Microsoft time zones (server#49741)

fixFix(files): cancel renaming on enter if no file name changes (server#49752)

fixFix(CalDAV): disable both iTip and iMip messages (server#49780)

fixFix(files): failsafe when executing actions methods (server#49792)

fixFix mimetype not being updated when changing file extention on objectstore (server#49794)

fixFix: Fix ServiceWorker scope when Nextcloud installed in subfolder (server#49798)

fixFix(files): throttle favorite with max 5 simultaneous requests (server#49805)

fixFix(files_sharing): Fix error messages from password policy (server#49822)

fixFix(files_external): wrong type for external mount id (server#49846)

fixFix: return 204 instead of 404 (server#49851)

fixFix: replace null character when serializing (server#49855)

fixFix(TemplateManager): Make sure TemplateFolder is a Folder (server#49877)

fixFix(share): Don't print twice the same text on emails (server#49878)

fixFix(ReferenceApiController): Bump rate limit for public resolve endpoint (server#49884)

fixFix(View): Catch exceptions when executing mkdir for non-existent parents (server#49894)

fixFix: make sure we have a valid scheme when testing ocm urls (server#49900)

fixFix(files): Only register preview service worker once when the instance is hosted at the root path (server#49918)

fixFix(share): render conflict modal in public shares (server#49924)

fixFix: Create empty file instead of file with a space (server#49936)

fixFix(shares): Remove noisy text from email (server#49994)

fixFix(federatedfilesharing): fix notification typo (server#50014)

fixFix: remove references to non-existent ShareTypes (server#50021)

fixFix(cypress): flaky live photo test grid_view trigger issue (server#50028)

fixFix(logger): Prevent infinite recursion with log.condition => users or matches (server#50031)

fixFix(app-store): add missing exApps list items to search filter (server#50032)

+39 more items in the release notes

30.0.4 Dec 12, 2024 Release notes ↗

feature[stable30] fix(app-store): Add back legacy store API used for update and removal

other[stable30] fix(activity): make emails for link share uploads true by default

otherchore(deps-dev): bump @nextcloud/cypress from 1.0.0-beta.8 to 1.0.0-beta.12

otherchore(deps-dev): bump @babel/node from 7.25.0 to 7.25.9

otherchore(deps-dev): bump cypress-split from 1.24.0 to 1.24.7

otherchore(deps): bump pinia from 2.2.6 to 2.2.8

otherchore(deps): bump @nextcloud/sharing from 0.2.3 to 0.2.4

other[stable30] fix(files_sharing): Stop infinite loop blocking link share requests

other30.0.4 RC1

other[stable30] fix(files_sharing): Correct property enforced property names

feature[stable30] fix(files_sharing): also submit new share on password submit

other30.0.4

30.0.3 Dec 5, 2024 Release notes ↗

securityFixes CVE-2025-47791: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently…

other[stable30] fix(files): multiselect and filters store declaration

other[stable30] fix(theming): Return default theme if the user never selected a theme

other[stable30] fix(TaskProcessingApiController): Don't use + to merge non-assoc. arrays

security[stable30] fix(net/security): Handle IPv6 zone IDs in link-local addresses

other[stable30] fix(files_sharing): note icon color on public pages

other[stable30] fix(SharingEntryLink): Show default password before create if any

other[stable30] fix(files): edit locally buttons and description

other[stable30] fix(files): open sidebar on sharing tab by default for files

otherchore(deps-dev): Bump @pinia/testing from 0.1.5 to 0.1.7

feature[stable30] feat(testing): Add a fake summary task provider

other[stable30] fix: undefined variable $response in DAV storage

other[stable30] fix(files_external): cast storage id int

other[stable30] fix: log a warning when we can't build a background job

other[stable30] docs: Adjust taiwan translators

other[stable30] fix(files): view-in-folder enabled conditions

feature[stable30] feat: Add X-NC-Disable-Scheduling property to allow skipping scheduling

other[stable30] fx(dav): file request guest nickname encoding

deprecated[stable30] fix(Middleware): log deprecation when annotation was actually used

other[stable30] Fix remaining readdir() calls in loops with undesirable false evaluation potential

other[stable30] Clear pending two factor tokens also from configuration

otherbuild(deps-dev): bump cypress from 13.13.2 to 13.13.3

other[stable30] chore: Update @nextcloud/upload and @nextcloud/files

other[stable30] chore(github): Update groupware code owners

other[stable30] [textprocessing] Fix: Accept scheduling a task if there are equivalent taskprocessing providers only

other[stable30] DNS: do not query CNAME if A succeeded already

feature[stable30] chore(deps): Add SabreDav Patch for iTip Broker

other[stable30] fix: override iTip Broker to fix several issues

other[stable30] fix: use invokePrivate for test

other[stable30] fix(caldav): duration handling in the event reader class

other[stable30] feat: mail provider settings

other[stable30] fix: RDATE and EXDATE property instances

other[stable30] fix: Do not check for strict cookie when running webcron

other[stable30] fix: Move cloud id into readonly input

otherbuild(deps-dev): bump jsdoc from 4.0.3 to 4.0.4

feature[stable30] test(fakeAI): Allow to specify whether the fake providers should fail

feature[stable30] feat(settings): add big file upload setup checks

feature[stable30] fix(files): Allow downloading multiple nodes not from same base

fixfix(SetupChecks): Make sure array key is set

security[stable30] fix(security): Update CA certificate bundle

+23 more items in the release notes

30.0.2 Nov 7, 2024 Release notes ↗

securityFixes CVE-2024-52523: Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the fronte…

securityFixes CVE-2024-52518: Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external stor…

securityFixes CVE-2025-47793: Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.…

securityFixes CVE-2024-52525: Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved…

other[stable30] fix: Make user removal more resilient

other[stable30] fix(files): Reset context menu position on close

feature[stable30] fix(files): Add more visual move / copy notification

other[stable30] fix: get rid of denied notification when accept

other[stable30] fix(share): Return empty string if no label is set

breaking[stable30] fix(files): Ensure children are removed from folder and not duplicated

other[stable30] feat(comments): Support mentioning emails

other[stable30] fix(appstore): Hide last modified information for shipped apps

security[stable30] fix(security): Update code signing revocation list

fix[stable30] fix(activity): Fix download activity parameters

feature[stable30] fix(AppConfig): Add external JWT private key to sensitive keys

other[stable30] build: Bump symfony/* to 6.4

feature[stable30] fix(files_sharing): Add proper user facing messages on success

other[stable30] ci: Update list of installed PHP extensions (as some are not default …

other[stable30] fix(files): Ensure renaming state is correctly reset

breaking[stable30] fix(filesexternal): Remove unneeded 3rdparty library use

breaking[stable30] fix(logger): Remove more parameters of other methods

feature[stable30] fix: add PasswordConfirmationRequired to create user storages endpoint

other[stable30] fix(app-store): Also proxy images of locally installed apps

other[stable30] fix(app-store): Ensure the groups property is always an array

other[stable30] fix(files): Adjust NavigationQuota for Nextcloud 30 design

feature[stable30] fix(files_sharing): Add correct context to translation

other[stable30] [TextProcessing] Fix: Also list types that are available in task processing

other[stable30] fix(app-store): Correctly render Markdown in app description

other[stable30] build: Print RTL limited characters in translation-checker

other[stable30] fix(ShareAPI): Send mails for mail shares by default

other[stable30] refactor(ShareApiController): Check for null and empty strings with e…

other[stable30] fix(files): handle empty view with error

feature[stable30] fix(files): add title for files list table header button

feature[stable30] fix: Allow overriding shouldApplyQuota check from child classes

other[stable30] fix(dav): Cleanup view-only check

feature[stable30] ci(psalm): Add missing imagick extension

fix[stable30] fix: Fix "Unknown path" error when source user files folder has not been initialized

feature[stable30] fix: add PasswordConfirmationRequired to the external storages mentioned in review

fix[stable30] fix: Fix empty sections appearing in search results

fix[stable30] fix: Fix "Reasons to use Nextcloud" design

+35 more items in the release notes

30.0.1 Oct 17, 2024 Release notes ↗

securityFixes CVE-2024-52517: Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain…

securityFixes CVE-2024-52513: Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in T…

other[stable30] fix(files_external): broken credentials dialog

other[stable30] fix(files): Adjust Cache::searchQuery() parameter name to match interface

other[stable30] fix(files_external): Check key exists before accessing it

other[stable30] fix(files_external): Handling in SFTP UI for custom ports

other[stable30] fix: Do not try to set HTTP response code on already closed connection

other[stable30] fix(Storage\Local): Do not call getSourcePath() on SplFileInfo

other[stable30] fix(Comment): Initialize childrenCount as integer

other[stable30] fix(Tags): Return boolean for userHasTags()

other[stable30] fix(BaseResponse): Cast XML element values to string

feature[stable30] fix(S3ConfigTrait): Allow proxy field to take false

other[stable30] fix: correct link to trademark

other[stable30] Update psalm-baseline.xml

otherchore(deps-dev): bump cypress-if from 1.12.5 to 1.12.6

otherchore(deps-dev): bump @pinia/testing from 0.1.4 to 0.1.5

other[stable30] chore(i18n): adapted lowercase

other[stable30] fix(LDAP): check index before accessing it

other[stable30] fix(files): Check if target path is a descendant of the shared folder

other[stable30] fix(config): Throw PreconditionException always when it didn't match

other[stable30] fix: Display 'Leave share' instead of 'Delete'

feature[stable30] fix(caldav, carddav): also allow unsharing of circle shares

other[stable30] fix(TaskProcessing): increase error_message column length

feature[stable30] fix(settings): Add back create group icon

feature[stable30] fix(a11y): Add OTF font loading check

fix[stable30] fix(weather_status): Fix search address errors when offline

feature[stable30] fix(config): Add missing handling for envCache in getKeys()

fix[stable30] fix(Entity): Fix magic setter call for custom strong typed setters

feature[stable30] ci: Bump phpunit to 9.6.19 and add dependabot

fix[stable30] fix(user_ldap): Use %n in plural translation to avoid a crash in L10N

feature[stable30] chore: add .git-blame-ignore-revs

fix[stable30] fix: Don't crash if disabled user is missing in the database

feature[stable30] Add bidirectional text support - Backend

security[stable30] fix(security): Update CA certificate bundle

fix[stable30] fix(tests): Fix test selection and run unit tests of DAV and user_status

fix[stable30] fix(files): Fix having to resolve conflicts twice when dropping files

fix[stable30] fix: Prevent crash when refreshing metadata for files without an owner

fix[stable30] fix(files): Fix folders not being selectable in the smart picker

feature[stable30] fix(caldav): add missing handlers

fix[stable30] fix(dav): don't crash subscription on invalid calendar object

+64 more items in the release notes

30.0.0 Sep 25, 2024 Release notes ↗

other30.0.0

29.0.16 Apr 17, 2025 Release notes ↗

security[stable29] fix(security): Update code signing revocation list

other[stable29] fix(dav): Really only run the chunk cleanup once

fix[stable29] fix(files_sharing): fix share creation error handling

other[stable29] fix: Handle missing share providers when promoting reshares

other[stable29] ignore missing theming app

other[stable29] fix(tests): Share manager error message from #52076

otherbuild(deps): bump dompurify from 3.2.4 to 3.2.5

other[stable29] fix(files_sharing): Apply default password setting in SharingDetailsTab

other[stable29] fix: only do cache copy in updater if the parent folder should be in cache

other[stable29] fix: Transfer ownership with S3 as primary

other29.0.16 RC1

other[stable29] fix(deps): pin jquery-ui to 1.13

other29.0.16

29.0.15 Apr 11, 2025 Release notes ↗

fixFix(db): Increase log level for very slow transactions (server#47529)

fixFix(logger): Prevent infinite recursion with log.condition => users or matches (server#50030)

fixFix: Apply enforce theme config for anonymous users as well (server#50121)

fixFix: Filter for folders in cleanup old preview job (server#50471)

fixFix(oauth2): retain support for legacy ownCloud clients (server#50902)

fixFix(files_trashbin): disable bulk download for trashbin (server#51208)

featureFeat: log query for dbal exceptions (server#51232)

fixFix(user_ldap): Avoid extra LDAP request when mapping a user for the first time (server#51255)

featureAdd LDAP test settings command (server#51305)

fixFix(dav): Create SAB at installation (server#51314)

fixFix: remote account activity translation (server#51324)

fixFix: Do not build encrypted password if there is none (server#51328)

fixFix disabled user list for SAML group subadmin (server#51374)

fixFix(files_external): Stop building path twice when checking if file exists on case insensitive SMB storage (server#51386)

featureFeat(files): Refresh grid view layout (server#51470)

fixFix(profile): allow to unset phone number (server#51509)

fixFix: skip caching lastSeenQuotaUsage for remote shares (server#51528)

fixFix(files): Make sure file pointer exists (server#51534)

fixFix(cardav): only show users from enabled addressBooks in contacts menu (server#51537)

fixFix(files_sharing): ensure share status action works also in grid view (server#51557)

fixFix: skip transfering shares that we can't find (server#51571)

fixFix: pass hide download attribute while creating the share to fix github issue 50788 (server#51580)

fixFix(systemtags): support new attribute parsing of webdav props (server#51590)

fixFix(css): ensure header title is readable with dark background (server#51599)

fixFix(files_sharing): skip expiration notify for invalid share record (server#51613)

fixFix(user): Some strings not being translated (server#51664)

fixFix(provisioning_api): Pass on translated hint if password change fails (server#51670)

fixFix(login): Improve CSRF error message for better user understanding (server#51701)

fixFix: filter out contacts with empty email addresses in sharee completion (server#51710)

fixFix(GenerateBlurhashMetadata): Suppress imagescale errors (server#51716)

fixFix(files_versions): correctly show version author also for shared files (server#51721)

fixFix(files_reminders): Fix reminder actions being displayed on invalid nodes (server#51740)

fixFix(files_versions): Rely on server mime fallback icons (server#51746)

fixFix(cs-fixer): Correctly ignore files ignored by git (server#51776)

fixFix(dav): Give proper HTTP status code on MKCOL when quota exceeded (server#51811)

featureFeat: Limit ExpireTrash job to 30 minutes (server#51819)

fixFix(users): Improve error handling of some fields update (server#51834)

featureRevert "refactor: add migration for email setting" (server#51985)

featureFeat(ip): use larger IPv6 range by default (server#52031)

+36 more items in the release notes

29.0.14 Mar 19, 2025 Release notes ↗

other[stable29] fix(mime-types): adjust compiled mime types and sign

other[stable29] ci: Update 3rdparty actions

other[stable29] fix(base.php): Correct order for booting \OC\Server

feature[stable29] fix(auth): Allow 2FA challenges for Ephemeral sessions

other29.0.14 RC1

other29.0.14

29.0.13 Mar 13, 2025 Release notes ↗

other[stable29] fix(files): Correctly copy the cache information during copy operations

deprecated[stable29] fix(repair): PHP8.3 deprecation warning

fix[stable29] Bug/48678/restore dav error response

otherchore(deps-dev): bump cypress-split from 1.24.9 to 1.24.11

other[stable29] fix(SharedStorage): Check if storage ID is set on cache

other[stable29] fix(login): only show error state on login box if user interacted

feature[stable29] fix(transferownership): Allow searching new owner by email

other[stable29] perf(files): faster query to fetch incomplete directories

other[stable29] fix(files): Do not download files with openfile query flag

other[stable29] fix(systemtags): do not hide if no tags

fix[stable29] fix(Mailer): Fix sendmail binary fallback

other[stable29] fix(files): properly forward open params from short urls

fix[stable29] fix(files_sharing): Fix public share expiration being set when toggle is not enabled

other[stable29] fix(files_external): request strict password auth on credentials enter action

other[stable29] fix: Change UserAgent to *cloud

other[stable29] ci(autochecks): Run some autochecks also on non-PHP files

other[stable29] fix: Initialize lastConnectionCheck after first connection

other[stable29] fix: wipe local storages on log out

security[stable29] fix(security): Update CA certificate bundle

other[stable29] fix(files_versions): Do not expire versions newer than min age

other[stable29] fix(l10n): Improve english source strings

other[stable29] fix: validate account properties as a repair step

other[stable29] Fix: NotFoundException for anonymous users

otherchore(deps-dev): bump @types/dockerode from 3.3.34 to 3.3.35

otherchore(deps): bump @nextcloud/files from 3.10.1 to 3.10.2

otherchore(deps-dev): bump cypress-split from 1.24.11 to 1.24.14

otherchore(deps-dev): bump @nextcloud/cypress from 1.0.0-beta.13 to 1.0.0-beta.14

other[stable29] fix(files_external): Move definition parameter to the correct place

other[stable29] feat: Close sessions created for login flow v2

other[stable29] fix: make sure we process mime extensions as string

other[stable29] fix(FederatedShareProvider): Delete external shares when groups are deleted or users removed from a group

feature[stable29] refactor(TempManager): Simplify and unify implementations and remove legacy behavior

other[stable29] fix: Report duplicated extra files in integrity check

other[stable29] fix(files_sharing): Also list deleted team shares

other[stable29] fix(dav): Handle long absence status earlier

other[stable29] fix(files): Don't do session related work in the constructor of the View

fix[stable29] fix(translation): Fix string concatenation in LDAP endpoint

feature[stable29] fix(test): Add missing data-cy attribute for file actions

fix[stable29] fix(external_storage): fix settings save

+10 more items in the release notes

29.0.12 Feb 13, 2025 Release notes ↗

other29.0.12

29.0.11 Jan 16, 2025 Release notes ↗

fixFix(files): ensure valid mtime and fallback to crtime if defined (server#49283)

fixFix(files): Make injected actions reactive (server#49425)

fixFix(external_storage): Cast id to int (server#49467)

fixFix(maintenance): Show a success message on data-fingerprint command (server#49590)

fixFix(setupcheck): Make the Memcache setupcheck use the cache (server#49593)

fixFix(files): properly update paths and folder children on node move (server#49609)

fixFix: Add command to update re-share if shared-by user has been revoked (server#49613)

featurePerf: improve performance of SharedStorage::getWatcher (server#49614)

featureAdd an error log message that notifications app isn't enabled at file… (server#49617)

fixFix(external_storage): Cast id to int (server#49623)

fixFix: smb: don't fail hard if we can't load acls for a file (server#49652)

fixFix: don't propagate future mtimes (server#49654)

fixFix incorrect permissions when copying shared files (server#49655)

fixFix(migration): Correctly sort migrations by version number (server#49668)

fixFix: don't do same-storage move optimization with encryption wrappers (server#49675)

fixFix(db): Create the systag_by_objectid index for new installations (server#49679)

fixFix(files_sharing): Stop infinite loop blocking link share requests (server#49723)

fixFix(files): cancel renaming on enter if no file name changes (server#49751)

fixFix(CalDAV): disable both iTip and iMip messages (server#49779)

fixFix(files): failsafe when executing actions methods (server#49791)

fixFix mimetype not being updated when changing file extention on objectstore (server#49793)

fixFix(files): throttle favorite with max 5 simultaneous requests (server#49806)

fixFix(files_sharing): Correct property enforced property names (server#49808)

fixFix(files_sharing): also submit new share on password submit (server#49816)

fixFix(files_sharing): Fix error messages from password policy (server#49836)

fixFix(files_external): wrong type for external mount id (server#49845)

fixFix: return 204 instead of 404 (server#49850)

fixFix: replace null character when serializing (server#49854)

fixFix(TemplateManager): Make sure TemplateFolder is a Folder (server#49876)

fixFix(View): Catch exceptions when executing mkdir for non-existent parents (server#49893)

fixFix: make sure we have a valid scheme when testing ocm urls (server#49901)

fixFix: promote re-shares when deleting the parent share (server#49927)

fixFix: Create empty file instead of file with a space (server#49938)

fixFix(federatedfilesharing): fix notification typo (server#50013)

fixFix(cypress): flaky live photo test grid_view trigger issue (server#50027)

fixFix(HTTP): Adjust JSONResponse data type (server#50057)

fixFix: block moving files to it's own parent with dav (server#50061)

fixFix(preview): Do not try to parse M3U files as MP3 (server#50080)

fixFix(SetupChecks): Don't test caches using binary data (server#50116)

featureAdd SPDX header (survey_client#357)

+23 more items in the release notes

29.0.10 Dec 5, 2024 Release notes ↗

other[stable29] fix(files): Ensure renaming state is correctly reset

other[stable29] fix(theming): Return default theme if the user never selected a theme

other[stable29] fix(files_sharing): note icon color on public pages

other[stable29] fix(files): edit locally buttons and description

other[stable29] fix: undefined variable $response in DAV storage

other[stable29] fix(files_external): cast storage id int

other[stable29] fix: log a warning when we can't build a background job

other[stable29] Fix remaining readdir() calls in loops with undesirable false evaluation potential

feature[stable29] feat: Add X-NC-Disable-Scheduling property to allow skipping scheduling

other[stable29] Clear pending two factor tokens also from configuration

other[stable29] fix(files): view-in-folder enabled conditions

other[stable29] chore: Update @nextcloud/files and @nextcloud/update libraries

other[stable29] chore(github): Update groupware code owners

other[stable29] DNS: do not query CNAME if A succeeded already

feature[stable29] chore(deps): Add SabreDav Patch for iTip Broker

other[stable29] fix: override iTip Broker to fix several issues

other[stable29] fix: Do not check for strict cookie when running webcron

other[stable29] fix(files): improve delete display name when trashbin is disabled

feature[stable29] fix(files): Allow downloading multiple nodes not from same base

feature[stable29] feat(settings): add big file upload setup checks

other[stable29] fix(job): Check if carddata is resource and read it to string

other[stable29] fix(storage): Try to delete existing target

other[stable29] fix(SetupChecks): Make sure array key is set

other[stable29] fix: (CalDav) Delete invitation link when deleting Calendars or Events

other[stable29] fix(BackgroundJobs): Adjust intervals and time sensitivities

other[stable29] fix(OCMDiscoveryService): Also cache error results during discovery

other[stable29] fix: invalid usage of IQueryBuilder::createNamedParameter()

security[stable29] fix(security): Update CA certificate bundle

other[stable29] fix: throw correct exception type when we can't verify if an s3 bucket exists

other[stable29] fix(migration): Decrypt ownCloud secrets v2

other[stable29] chore: stricter access to testremote endpoint

other29.0.10 RC1

other[stable29] fix(setupcheck): Disable PhpMaxFileSize setupcheck for now

other29.0.10

29.0.9 Nov 7, 2024 Release notes ↗

feature[stable29] fix: Allow overriding shouldApplyQuota check from child classes

other[stable29] fix(setup-checks): Ensure URL with webroot works

feature[stable29] fix(files): Add more visual move / copy notification

other[stable29] fix(locking): Accept mixed as value on setTTL

feature[stable29] fix(dav): Public WebDAV endpoint should allow GET requests

other[stable29] Fix email share transfer accross storages

other[stable29] fix(share): Return empty string if no label is set

breaking[stable29] fix(files): Ensure children are removed from folder and not duplicated

other[stable29] fix: get rid of denied notification when accept

other[stable29] fix: Make user removal more resilient

fix[stable29] fix(message): Fix logic of Mail test

other[stable29] fix(appstore): Hide last modified information for shipped apps

security[stable29] fix(security): Update code signing revocation list

fix[stable29] fix(activity): Fix download activity parameters

feature[stable29] fix(AppConfig): Add external JWT private key to sensitive keys

feature[stable29] fix(files_sharing): Add proper user facing messages on success

other[stable29] ci: Update list of installed PHP extensions (as some are not default …

breaking[stable29] fix(logger): Remove more parameters of other methods

other[stable29] build: Print RTL limited characters in translation-checker

feature[stable29] fix: add PasswordConfirmationRequired to create user storages endpoint

otherchore(deps-dev): Bump jsdoc from 4.0.2 to 4.0.4

other[stable29] fix(dav): Cleanup view-only check

feature[stable29] fix(files): add title for files list table header button

other[stable29] fix(files_sharing): Cleanup error messages

other[stable29] fix(app-store): Update update count in navigation

other[stable29] fix: encrypt and store password, decrypt and retrieve the same

other[stable29] fix(config): Mark more configs as sensitive

other[stable29] fix(files): handle empty view with error

other[stable29] fix(files_sharing): federated shares avatar

feature[stable29] ci(psalm): Add missing imagick extension

other[stable29] fix: do not reduce count for subadmins if they are members of group

feature[stable29] fix: add PasswordConfirmationRequired to the external storages mentioned in review

other[stable29] Fix copying or moving from shared groupfolders

other[stable29] fix(files): Do not jump to top when fileId is set to currentFolder

feature[stable29] test: re-add object store primary storage phpunit tests

other[stable29] fix: provision api's status codes

+16 more items in the release notes

29.0.8 Oct 10, 2024 Release notes ↗

other[stable29] fix(files_external): Handling in SFTP UI for custom ports

other[stable29] fix(files_external): broken credentials dialog

other[stable29] fix(files): Adjust Cache::searchQuery() parameter name to match interface

other[stable29] fix(files_external): Check key exists before accessing it

other[stable29] fix: Do not try to set HTTP response code on already closed connection

other[stable29] fix(Comment): Initialize childrenCount as integer

other[stable29] fix(Storage\Local): Do not call getSourcePath() on SplFileInfo

other[stable29] fix(Tags): Return boolean for userHasTags()

other[stable29] Update psalm-baseline.xml

feature[stable29] fix(S3ConfigTrait): Allow proxy field to take false

feature[stable29] fix(settings): Add back create group icon

other[stable29] fix: Display 'Leave share' instead of 'Delete'

other[stable29] fix: make swift connect exception message more informative

other[stable29] fix(files): Reset context menu position on close

other[stable29] fix(files_sharing): password checkbox and labels in link share

fix[stable29] fix: Fix inaccessible content on public pages due to overlapping footer

other[stable29] fix(files): Check if target path is a descendant of the shared folder

other[stable29] fix(LDAP): check index before accessing it

other[stable29] fix(appstore): return if appstore is manually disabled

other[stable29] fix(BaseResponse): Cast XML element values to string

other[stable29] fix(preview): gracefully handle file not being opened in ProviderV2

other[stable29] fix(appstore): Ensure returned apps from AppStore are valid

other[stable29] fix(dav): set string type for sanitizeMtime

other[stable29] fix(config): Throw PreconditionException always when it didn't match

other[stable29] fix: Run migration sql as statement so that the primary db node is used

other[stable29] fix: Only write once to template instead of create/copy

other[stable29] fix(a11y): Update OpenDyslexic from 0.920 to 2.001

other[stable29] fix(dav): cast parameters to string

other[stable29] feat: Reset route if neither the Viewer of the Sidebar is open

fix[stable29] fix(Entity): Fix magic setter call for custom strong typed setters

feature[stable29] fix(config): Add missing handling for envCache in getKeys()

feature[stable29] chore: add .git-blame-ignore-revs

fix[stable29] fix: Don't crash if disabled user is missing in the database

feature[stable29] Add bidirectional text support - Backend

breaking[stable29] refactor(AccountIcon): Remove needless console.log

security[stable29] fix(security): Update CA certificate bundle

fix[stable29] fix(files): Fix having to resolve conflicts twice when dropping files

fix[stable29] fix: Prevent crash when refreshing metadata for files without an owner

+31 more items in the release notes

29.0.7 Sep 12, 2024 Release notes ↗

securityFixes CVE-2024-52520: Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find ope…

securityFixes CVE-2024-52519: Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextclou…

securityFixes CVE-2024-52521: Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely be…

other[stable29] fix(dav): Always respond custom error page on exceptions

other[stable29] fix: Replace conflicting tags in xml_exception template

other29.0.7

29.0.6 Sep 3, 2024 Release notes ↗

other[stable29] Don't save translated predefined user status as custom status

fix[stable29] fix(setupcheck): Fix mimetype server version check in backport

other[stable29] chore(deps): Update @nextcloud/upload

other[stable29] fix(theming): Make getImage() call save against missing non-SVG version

other[stable29] fix(ProvisioningAPI): set typed config values by via API

feature[stable29] fix(provisioning): Support setting new app configs as well

other[stable29] fix(caldav): limit property length

other[stable29] fix: Trusted server icon recovery without addressbook change

fixStable29: Fix/comment deleting with activities installed

other[stable29] fix(mailer): Call to custom mail_template_class

other[stable29] fix(flow): cannot set custom user agent

other[stable29] fix(files): Adjust margin at the file list bottom

other[stable29] fix(files): Reset drop notice on firefox

other[stable29] fix: Correctly load favorites for subpath

other[stable29] fix(Router): Load attribute routes of all apps when not app is specified

other[stable29] Fix npm audit

other[stable29] fix(userstatus): run user status automation job for start and end events

other[stable29] fix: gracefully handle unexpected exif orientation types

fix[stable29] fix(files): fix list gap at bottom

other[stable29] fix(logger): ignore session logging during setup

other[stable29] refactor(files): Drop unneeded initial state

breaking[stable29] fix(provisionning_api): Remove parameters that are not set into template

other[stable29] Update @nextcloud/vue to v8.17.0

other[stable29] fix: optimise getWrongShareOwnership query

other29.0.6 RC1

other[stable29] fix(settings): Hide forbidden UI elements for group managers

fix[stable29] Revert "fix(deps): Fix npm audit"

other29.0.6

29.0.5 Aug 20, 2024 Release notes ↗

securityFixes CVE-2024-52516: Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously…

fixFix(redis): Require version >=4 for unlink (server#46521)

fixFix(theming): enforce theme should still provide dark as fallback (server#46522)

fixFix(files): Close sidebar on navigation (server#46529)

fixFix(files_metadata): Don't run generation job on every upgrade (server#46564)

fixFix(previews): Stop returning true when getimagesize() fails (server#46569)

fixFix(appstore): Return an empty array in case of fail (server#46578)

fixFix(caldav): lower scheduling table size warning (server#46582)

fixFix(caldav): Throw 403 Forbidden Error instead of 500 Internal Server… (server#46602)

fixFix(caldav): decode values before returning (server#46614)

fixFix(dashboard): Unify widget icon colors and document it's behaviour (server#46626)

fixFix(mail): Fix big logos in mail templates for Outlook (server#46627)

fixFix(TextProcessing): use error instead of info for exception logging (server#46636)

fixFix(dav): Thrown forbidden error for authenticated user instead of no… (server#46646)

fixFix(Token): take over scope in token refresh with login by cookie (server#46669)

fixFix: Pass the mountpoint target user to storages without owner (server#46679)

featureFeat: add config flag to toggle persistent redis connections (server#46684)

fixFix(caldav): stricter default calendar checks (server#46696)

fixFix(files): validate input when creating file/directory (server#46718)

fixFix: FileInfo from View should have the correct name of a mountpoint (server#46721)

fixFix(search): show user search provider for deactivated and admin pages (server#46725)

fixFix(files): ensure forbiddenCharacters is an array (server#46731)

fixFix(files_versions): avoid unintentional skipping of expiration (server#46740)

featureFeat: add a specialized writeStream implementation for s3 external storage (server#46743)

featureFeat: add additional logging for database errors (server#46750)

fixFix: Add .whiteboard alias for .excalidraw files (server#46752)

fixFix(files_sharing): open-in-files should open a folder and not the parent (server#46755)

fixFix: add a try and catch for delete versioning (server#46758)

fixFix(files): Correctly validate new node name (server#46774)

fixFix(files): always ask for confirmation if trashbin app is disabled (server#46801)

fixFix(styles): Make sure footer with legal links is shown correctly (server#46811)

fixFix: fix recursive share check (server#46863)

fixFix(files): correctly shrink breadcrumbs bar (server#46866)

fixFix: OCP\Files\Node\Folder::search was not setting the owner (server#46869)

fixFix(trashbin): Improve documentation of since/until timestamps of res… (server#46900)

featurePerf(systemtags): Add index for systemtags_object_mappings.objectid (server#46906)

featureFeat(editLocallyAction): Handle possible no local client scenario (server#46910)

featureEnh(metadata): Introduce a memory limit for metadata generation (server#47027)

securityFix(security): Update expiration date in security.txt (server#47230)

featureFeat: dismiss notification when accepting an invitation (circles#1647)

+67 more items in the release notes

29.0.4 Jul 26, 2024 Release notes ↗

fix[stable29] test(theming): Fix unit tests for personal settings

other[stable29] fix(ci): Correctly check for assets that need compilation

other[stable29] fix(CI): Update setup-php, setup-node, checkout and paths-filter actions

feature[stable29] fix(files_sharing): also allow removing READ permissions on email shares

other[stable29] stop file actions when conflict dialog skipped

other29.0.4

29.0.3 Jun 25, 2024 Release notes ↗

other[stable29] fix(theming): replace standard generic package icon by material design

other[stable29] fix(caldav): automatically delete outdated scheduling objects

other[stable29] fix(session): Do not update authtoken last_check for passwordless

fix[stable29] fix(INavigationManager): Fix psalm alias not set in the right place

feature[stable29] fix(core): Add missing null value possibility to Resource and Reference richObject

other[stable29] fix(files_sharing): usage of NcTextField in SelectShareFolderDialogue

other[stable29] Avoid updating the same oc_authtoken row twice

other[stable29] fix: Update @nextcloud/files to fix public link shares

other[stable29] fix(core): unsupported browser redirect url

other[stable29] fix(federatedfilesharing): import external federated share script

other[stable29] fix(appconfig): format app values

other[stable29] fix(files): Display selected files count

feature[stable29] feat: Add legal notice and privacy policy links to help page

fix[stable29] fix: regression with updating read-only config

other[stable29] fix(files): Don't fail if dir exists

other[stable29] fix: register DI alias for IFileAccess

feature[stable29] feat: Add forbidden_filename_characters to JSConfig for use in frontend libraries

other[stable29] fix(files): Only execute default action if there is an action to perform

other[stable29] fix(files): Close sidebar and update fileid when current node is deleted

other[stable29] CalDAV fix search with limit and time range

other[stable29] fix(settings): show warning for indexToReplace as part of missing indices

other[stable29] fix(dav): Rate limit address book creation

other[stable29] unmark deleted users if their last login date is more recent than deleted date

other[stable29] fix(files): Ensure active file list entry is highlighted

other[stable29] fix(files): Make sure files are opened when using open-in-files action(s) or at lease are scrolled into view

other[stable29] ci(eol): update workflow from template

other[stable29] fix(dav): Don't log access control as error

fixfix(settings): Use axios directly for health check to preven URL sanitizing

other[stable29] fix: Autodetect legacy filekey instead of trusting the header for legacy header

feature[stable29] fix(Mailer): Allow to enforce strict email format

other[stable29] fix(search): tags redirect route

other[stable29] fix: Only list remnants as disabled if option is enabled

fix[stable29] fix(files_sharing): fix parsing of remote shares

feature[stable29] fix(files): also trigger new tab on file name middle click

feature[stable29] fix(Token): make new scope future compatible

feature[stable29] test: add tests for ProfilePageController

fix[stable29] fix(ObjectStore): Fix regression when hostname is empty

feature[stable29] 44032 fix show new shares without refresh

feature[stable29] feat: add option to disable scanner transactions

feature[stable29] fix(Token): add FILESYSTEM scope with SCOPE_SKIP_PASSWORD_VALIDATION

+23 more items in the release notes

29.0.2 Jun 6, 2024 Release notes ↗

other[stable29] Expose subscription calendars

other[stable29] fix(contactsmenu): empty content margin

other[stable29] enh(metadata): migrate metadata to lazy appconfig

feature[stable29] feat: Add back searching in disabled user list

fix[stable29] fix(comments): Fix issues thrown by comments sidebar tab code

other[stable29] fix(db): Prevent two connections for single node databases

feature[stable29] fix(files): Focus filename input in new-node dialog when opened

other[stable29] Fix header menu icon color

other[stable29] perf(db): Sort data for IN before chunking

other[stable29] fix: Mark more configs as sensitive

other[stable29] fix(db): Log long transaction times at debug level

other[stable29] fix: forbid moving a folder into a subfolder of itself

feature[stable29] fix(files): Implement SortingService to fix sorting of files

fix[stable29] fix: fix FileAccess::getByFileId(InStorage)

feature[stable29] feat: add request id as comment to all queries

other29.0.2 RC1

other[stable29] fix(userstatus): catch unique constrain violation on revert

other29.0.2 RC2

other[stable29] Respect empty expiryDate value in server

other29.0.2

29.0.1 May 28, 2024 Release notes ↗

securityFixes CVE-2024-52515: Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If…

feature[stable29] fix(groups): allows to save group names with more than 64 characters

other[stable29] fix(db): Prevent data loss by temporarily disabling db:convert-type

other29.0.1

29.0.0 Apr 24, 2024 Release notes ↗

other29.0.0

fix[stable29] fix: Fix truncation on public page

28.0.14 Dec 12, 2024 Release notes ↗

other[stable28] fix(maintenance): Show a success message on data-fingerprint command

otherchore(deps-dev): bump @types/dockerode from 3.3.29 to 3.3.32

otherchore(deps-dev): bump @cypress/vue2 from 2.1.0 to 2.1.1

other[stable28] fix(files_sharing): Stop infinite loop blocking link share requests

other28.0.14 RC1

other[stable28] fix(files_sharing): Correct property enforced property names

feature[stable28] fix(files_sharing): also submit new share on password submit

other28.0.14

28.0.13 Dec 5, 2024 Release notes ↗

other[stable28] fix(theming): Return default theme if the user never selected a theme

other[stable28] fix(files_sharing): note icon color on public pages

other[stable28] fix(SharingEntryLink): Show default password before create if any

otherchore(deps-dev): Bump @pinia/testing from 0.1.3 to 0.1.7

other[stable28] fix: undefined variable $response in DAV storage

other[stable28] fix(files_external): cast storage id int

other[stable28] fix: log a warning when we can't build a background job

other[stable28] Fix remaining readdir() calls in loops with undesirable false evaluation potential

other[stable28] fix(files): view-in-folder enabled conditions

other[stable28] Clear pending two factor tokens also from configuration

otherbuild(deps-dev): bump @types/jest from 29.5.12 to 29.5.14

feature[stable28] feat: Add X-NC-Disable-Scheduling property to allow skipping scheduling

other[stable28] chore(github): Update groupware code owners

feature[stable28] chore(deps): Add SabreDav Patch for iTip Broker

otherbuild(deps): bump dompurify from 3.1.6 to 3.1.7

other[stable28] fix: override iTip Broker to fix several issues

feature[stable28] fix(files): Allow downloading multiple nodes not from same base

other[stable28] fix(files): improve delete display name when trashbin is disabled

other[stable28] fix(files): edit locally buttons and description

feature[stable28] feat(settings): add big file upload setup checks

other[stable28] fix(job): Check if carddata is resource and read it to string

other[stable28] fix(storage): Try to delete existing target

otherchore(deps-dev): bump @nextcloud/cypress from 1.0.0-beta.9 to 1.0.0-beta.10

otherchore(deps-dev): bump jsdoc from 4.0.3 to 4.0.4

other[stable28] fix: (CalDav) Delete invitation link when deleting Calendars or Events

other[stable28] fix(BackgroundJobs): Adjust intervals and time sensitivities

other[stable28] fix(OCMDiscoveryService): Also cache error results during discovery

other[stable28] fix: invalid usage of IQueryBuilder::createNamedParameter()

security[stable28] fix(security): Update CA certificate bundle

other[stable28] DNS: do not query CNAME if A succeeded already

other[stable28] fix(migration): Decrypt ownCloud secrets v2

other[stable28] chore: stricter access to testremote endpoint

other28.0.13 RC1

other[stable28] fix(setupcheck): Disable PhpMaxFileSize setupcheck for now

other28.0.13

28.0.12 Nov 7, 2024 Release notes ↗

feature[stable28] fix: Allow overriding shouldApplyQuota check from child classes

otherchore(deps-dev): Bump @nextcloud/cypress from 1.0.0-beta.8 to 1.0.0-beta.9

other[stable28] Fix email share transfer accross storages

feature[stable28] fix(files): Add more visual move / copy notification

other[stable28] fix: get rid of denied notification when accept

feature[stable28] fix(AppConfig): Add external JWT private key to sensitive keys

other[stable28] fix: Make user removal more resilient

other[stable28] fix(share): Return empty string if no label is set

fix[stable28] fix(message): Fix logic of Mail test

security[stable28] fix(security): Update code signing revocation list

breaking[stable28] fix(logger): Remove more parameters of other methods

feature[stable28] fix(files_sharing): Add proper user facing messages on success

feature[stable28] fix: add PasswordConfirmationRequired to create user storages endpoint

other[stable28] build: Print RTL limited characters in translation-checker

other[stable28] fix(files): undefined displayname for outdated @nextcloud/files<3.6.0 apps

fix[stable28] fix: Fix "Unknown path" error when source user files folder has not been initialized

feature[stable28] fix(files): add title for files list table header button

other[stable28] fix(dav): Cleanup view-only check

other[stable28] fix(files_sharing): Cleanup error messages

other[stable28] fix: encrypt and store password, decrypt and retrieve the same

other[stable28] fix(files): handle empty view with error

other[stable28] fix(config): Mark more configs as sensitive

other[stable28] fix(files_sharing): federated shares avatar

feature[stable28] ci(psalm): Add missing imagick extension

other[stable28] fix: do not reduce count for subadmins if they are members of group

feature[stable28] fix: add PasswordConfirmationRequired to the external storages mentioned in review

other[stable28] Fix copying or moving from shared groupfolders

other[stable28] fix: provision api's status codes

other[stable28] fix(locking): Accept mixed as value on setTTL

other[stable28] chore(deps): Update @nextcloud/upload to at least 1.5.0

feature[stable28] fix: add PasswordConfirmationRequired to saveGlobalCredentials

feature[stable28] fix(ShareEntryLinkList): Append new links to the end of list

otherbuild(deps): bump @nextcloud/password-confirmation from 5.1.0 to 5.1.1

other[stable28] ci: fail psalm when baseline update required

other[stable28] Fix disabled user list for subadmins

other[stable28] fix(files-external): set password as sensitive

+7 more items in the release notes

28.0.11 Oct 10, 2024 Release notes ↗

other[stable28] fix(files_external): broken credentials dialog

other[stable28] fix(files): Adjust Cache::searchQuery() parameter name to match interface

other[stable28] fix(files_external): Check key exists before accessing it

other[stable28] fix(Tags): Return boolean for userHasTags()

other[stable28] fix(Comment): Initialize childrenCount as integer

other[stable28] Update psalm-baseline.xml

other[stable28] fix(Storage\Local): Do not call getSourcePath() on SplFileInfo

other[stable28] fix: Only write once to template instead of create/copy

fix[stable28] fix: Fix inaccessible content on public pages due to overlapping footer

other[stable28] fix(LDAP): check index before accessing it

other[stable28] fix(BaseResponse): Cast XML element values to string

other[stable28] fix: Do not try to set HTTP response code on already closed connection

other[stable28] fix(appstore): Ensure returned apps from AppStore are valid

other[stable28] fix(files): Reset context menu position on close

other[stable28] fix: Display 'Leave share' instead of 'Delete'

other[stable28] fix(dav): set string type for sanitizeMtime

other[stable28] fix(config): Throw PreconditionException always when it didn't match

other[stable28] fix(preview): gracefully handle file not being opened in ProviderV2

other[stable28] fix(appstore): return if appstore is manually disabled

other[stable28] feat: Reset route if neither the Viewer of the Sidebar is open

other[stable28] fix(dav): cast parameters to string

fix[stable28] fix(Entity): Fix magic setter call for custom strong typed setters

other[stable28] 🥅 — Catch MaxInstancesExceededException on calendar events

other[stable28] Ensure that the hash method does not return null

fix[stable28] chore(1i8n): Fixed grammar and improved wording

other[stable28] fix(FileList): Show correct avatar for federated share owner

fix[stable28] fix: Prevent crash when refreshing metadata for files without an owner

other[stable28] fix(appstoreFetcher): get list from a custom store and remove unnecessary warning

feature[stable28] fix(config): Add missing handling for envCache in getKeys()

feature[stable28] chore: add .git-blame-ignore-revs

other[stable28] fix: skip the integrity check for nextcloud-init-sync.lock

other[stable28] fix(psalm): Enable findUnusedBaselineEntry

fix[stable28] fix: Don't crash if disabled user is missing in the database

feature[stable28] Add bidirectional text support - Backend

security[stable28] fix(security): Update CA certificate bundle

fix[stable28] fix(files): Fix having to resolve conflicts twice when dropping files

breaking[stable28] refactor(AccountIcon): Remove needless console.log

other[stable28] fix: Show storage full warning when storage is actually full

+20 more items in the release notes

28.0.10 Sep 12, 2024 Release notes ↗

other[stable28] fix(dav): Always respond custom error page on exceptions

other[stable28] fix(files): Correctly parse external shares for files UI

other28.0.10

28.0.9 Aug 20, 2024 Release notes ↗

fixFix(comments): Fix issues thrown by comments sidebar tab code (server#44902)

fixFix(cypress): wait for apps list fetch for better testing stability (server#46384)

fixFix(redis): Require version >=4 for unlink (server#46520)

fixFix(theming): enforce theme should still provide dark as fallback (server#46523)

fixFix(comments): Use proper icon components instead of icon classes to fix dark mode (server#46524)

fixFix(files_metadata): Don't run generation job on every upgrade (server#46563)

fixFix(appstore): Return an empty array in case of fail (server#46577)

fixFix(caldav): lower scheduling table size warning (server#46580)

fixFix(caldav): Throw 403 Forbidden Error instead of 500 Internal Server… (server#46603)

fixFix(caldav): decode values before returning (server#46613)

fixFix(mail): Fix big logos in mail templates for Outlook (server#46628)

fixFix(TextProcessing): use error instead of info for exception logging (server#46637)

fixFix(dav): Thrown forbidden error for authenticated user instead of no… (server#46647)

fixFix(Token): take over scope in token refresh with login by cookie (server#46668)

featureAllow injecting the user temporarily for direct editing (server#46678)

featureFeat: add config flag to toggle persistent redis connections (server#46683)

fixFix(files): validate input when creating file/directory (server#46717)

fixFix: FileInfo from View should have the correct name of a mountpoint (server#46720)

fixFix(search): show user search provider for deactivated and admin pages (server#46724)

fixFix(files): ensure forbiddenCharacters is an array (server#46734)

featureFeat: add a specialized writeStream implementation for s3 external storage (server#46742)

featureFeat: add additional logging for database errors (server#46751)

fixFix(files_sharing): open-in-files should open a folder and not the parent (server#46754)

fixFix: add a try and catch for delete versioning (server#46757)

fixFix: Add .whiteboard alias for .excalidraw files (server#46781)

fixFix(files): always ask for confirmation if trashbin app is disabled (server#46802)

fixFix(styles): Make sure footer with legal links is shown correctly (server#46808)

fixFix(sharing): Disable "Read permission" checkbox correctly (server#46841)

fixFix: fix recursive share check (server#46862)

fixFix: OCP\Files\Node\Folder::search was not setting the owner (server#46868)

featurePerf(systemtags): Add index for systemtags_object_mappings.objectid (server#46905)

featureFeat(editLocallyAction): Handle possible no local client scenario (server#46909)

fixFix(files): do not show legacy edit locally action on public pages (server#46932)

fixFix(files): empty folder pending size (server#46947)

fixFix(AdminSettings/AI): show pref list of only the enabled translation providers (server#46950)

fixFix(userstatus): add missing parenthesis (server#46959)

fixFix(setupchecks): Skip checking for OPcache settings if running checks from CLI (server#46964)

fixFix(LDAP): remove unneeded dependencies (server#46968)

securityFix(security): Update expiration date in security.txt (server#47231)

+45 more items in the release notes

28.0.8 Jul 26, 2024 Release notes ↗

other[stable28] fix(ci): Use low runners were possible

other[stable28] fix(CI): Update setup-php, setup-node, checkout and paths-filter actions

feature[stable28] fix(files_sharing): also allow removing READ permissions on email shares

other[stable28] stop file actions when conflict dialog skipped

other28.0.8

28.0.7 Jun 25, 2024 Release notes ↗

feature[stable28] fix(contactsinteraction): Allow vCard download

feature[stable28] feat: Add back searching in disabled user list

other[stable28] fix(files): properly reset preview component

feature[stable28] fix(files): Implement SortingService to fix sorting of files

other[stable28] fix(contactsmenu): empty content margin

other[stable28] feat: Limit email input to 255 chars

other[stable28] fix: Mark more configs as sensitive

other[stable28] Fix header menu icon color

other[stable28] fix(session): Do not update authtoken last_check for passwordless

other[stable28] fix(userstatus): catch unique constrain violation on revert

other[stable28] perf(db): Sort data for IN before chunking

other[stable28] fix(theming): replace standard generic package icon by material design

other[stable28] fix(files): Don't fail if dir exists

feature[stable28] fix(groups): allows to save group names with more than 64 characters

other[stable28] fix(files): Ensure active file list entry is highlighted

other[stable28] Expose subscription calendars

other[stable28] fix: Refresh file picker on folder creation

other[stable28] fix: Update @nextcloud/files to fix public link shares

other[stable28] Avoid updating the same oc_authtoken row twice

breaking[stable28] fix(memcache): remove double $$ to fix error

other[stable28] unmark deleted users if their last login date is more recent than deleted date

fix[stable28] fix(dav): Add occ command to fix missing caldav sync tokens

other[stable28] fix: delete user credentials stored in storages_credentials when user gets deleted

breaking[stable28] fix(CalDAV): remove UNKNOWN from room / resource consideration

fix[stable28] fix(INavigationManager): Fix psalm alias not set in the right place

feature[stable28] fix(core): Add missing null value possibility to Resource and Reference richObject

feature[stable28] fix(dav): Add retention time to sync token cleanup

fix[stable28] fix: Fix truncation on public page

feature[stable28] feat: add request id as comment to all queries

fix[stable28] fix(files): Fix ownership transfer encrypted files detection

fix[stable28] fix: regression with updating read-only config

feature[stable28] fix(Mailer): Allow to enforce strict email format

fix[stable28] fix(files_sharing): fix parsing of remote shares

feature[stable28] fix(files): also trigger new tab on file name middle click

feature[stable28] test: add tests for ProfilePageController

feature[stable28] 44032 fix show new shares without refresh

feature[stable28] feat: add option to disable scanner transactions

fix[stable28] fix(ObjectStore): Fix regression when hostname is empty

feature[stable28] fix(files_sharing): Add one string for every share type + fix(sharingDetails): Show correct share target

feature[stable28] fix(Token): add FILESYSTEM scope with SCOPE_SKIP_PASSWORD_VALIDATION

+46 more items in the release notes

28.0.6 May 28, 2024 Release notes ↗

securityFixes CVE-2024-37887: Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.…

other28.0.6

28.0.5 Apr 25, 2024 Release notes ↗

securityFixes CVE-2024-52514: Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the int…

other28.0.5

28.0.4 Mar 28, 2024 Release notes ↗

securityFixes CVE-2024-37882: Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server…

securityFixes CVE-2024-37313: Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommen…

securityFixes CVE-2024-37884: Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended th…

featureAdd "-i" to sendmail's pipe (server#43788)

featureAdd some recursive detection/prevention (server#44320)

fixBug fix: Select the correct table based on CALENDAR_TYPE_CALENDAR (server#43800)

deprecatedDeprecated sysconfig 'enable_file_metadata' (server#44124)

featureDo not create a new version for empty files (server#43929)

featureFeat: Restore unified search filtering in files view (server#44024)

featureFeat(share): save date and time for expiration (server#43833)

fixFix CSP for script-src with nonce on edge (server#44088)

fixFix data type in FilesMetadata::setIntList() (server#43801)

fixFix xml ocs response for serializable objects (server#44265)

fixFix: Allow to disable multipart copy on external s3 storage (server#43816)

fixFix: Avoid clear cache with prefix (server#44080)

fixFix: Avoid race condition that may initialize a document twice on the clients (text#5478)

fixFix: avoid scanning a non existing directory (server#44208)

fixFix: Catch exception from LogIteratorFactory, throw a clean error when log_type is not file (logreader#1197)

fixFix: changed login-page to reflect correct LDAP settings (server#44111)

fixFix: changed text alignment and icon logic (server#43916)

fixFix: Display "+New" while files page loads instead of "+Add". (server#43858)

fixFix: Ensure correct stacking context for right click menu (server#44212)

fixFix: ensure nested mount points are handled in the correct order (server#44285)

fixFix: fallback from guessing the owner from path in versioning (server#44248)

fixFix: Fetch custom app store url without internet connection (server#43985)

fixFix: filerobot-image-editor (viewer#2249)

fixFix: List specific share permissions as subline (server#44251)

fixFix: merge conflict dialog added when overwriting files on move-file action (server#43811)

fixFix: No password set for new mail shares (server#44194)

fixFix: support 28 Files (recommendations#709)

fixFix: Throw instead of yielding nothing when listing local directories (server#43828)

fixFix(ActionInsertLink): Sync NcActionInput value property (text#5425)

fixFix(admin role): fix old and wrong way to determine whether user is admin (server#43817)

fixFix(api): Ignore "parsed" link and icon urls when deleting (notifications#1859)

fixFix(attachments): Don't use currentSession for fetching attachments (text#5486)

fixFix(backend): Accept pushs with only step1 messages by read-only clients (text#5471)

fixFix(caldav): add EXDATE and EXRULE to confidential object (server#44386)

fixFix(CI): Correctly test against stable28 again (activity#1565)

fixFix(config): Make sure user keys are strings (server#44336)

fixFix(core): Convert text to path in f-droid banner SVG (server#43864)

+46 more items in the release notes

28.0.3 Mar 1, 2024 Release notes ↗

securityFixes CVE-2024-37315: Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is re…

other[stable28] fix(settings): Disable renaming for tokens marked to be wiped

other[stable28] fix(Request): Catch exceptions in isTrustedProxy

other[stable28] dont reuse etag for folders marked explicitly unscanned

other[stable28] Document throwing behavior of SetupResult upon invalid rich object

other[stable28] fix(files): make sure we focus the parent actions submenu entry

other[stable28] fix(a11y): Unified search headings the sequel

other[stable28] fix(tests): Make PostgreSQL unit tests less flacky by ordering

other[stable28] fix(files_sharing): Return focus to trigger element on sharing details close

other[stable28] enh(UnifiedSearch): Keep the searchbar on top of the modal

other[stable28] fix(files): combine navigation and files list into single Vue app

other[stable28] Buffer chunked requests

feature[stable28] fix: added a label element to the NcSelect in update settings

other[stable28] fix(settings): set viewBox on SVG icons

other[stable28] chore: Bump @nextcloud/vue to v8.5.1

other[stable28] handle storage not available when expiring versions

other[stable28] Move modal outside of the Version component.

fix[stable28] fix(a11y): Fix informative graphics contrast of user status icons

other[stable28] Remove disputed bz2 check

fix[stable28] fix(user_status): Fix losing focus to body when closing user status modal

fix[stable28] fix(apps): Fix type information of app manager

fix[stable28] dav: fix wrong decoding of pluses in URLs

feature[stable28] fix: added last two places for aria-labels on setting icons

security[stable28] fix(security): Update code signing revocation list

feature[stable28] fix(files): add mount root property and adjust delete wording

feature[stable28] fix(files): Allow to set node name before creating + bring back new-file highlingting

feature[stable28] Allow application to pass external links in navigation

feature[stable28] SMB: allow to list root directory when using case-insensitive option

fix[stable28] Fix for previews not being generated sometimes

breaking[stable28] chore: Remove old theming migration steps as they are only needed once

feature[stable28] fix: Add bruteforce protection to email endpoint

feature[stable28] enh(files_reminders): Allow clearing reminders

feature[stable28] fix(userstatus): add back 0 timestamp for status without message

feature[stable28] fix: Add bruteforce protection to federation endpoint

feature[stable28] fix(styles): Add default styles for disabled elements

feature[stable28] feat: added l10n translation prop to calendar component

fix[stable28] fix(settings): Fix required groups validation for subadmins

feature[stable28] chore(cypress): add 3 more runners

deprecated[stable28] Move away from deprecated utf8_encode() on PHP 8.2+

security[stable28] fix(security): Describe occ security:bruteforce:attempts accurately

+54 more items in the release notes

28.0.2 Feb 1, 2024 Release notes ↗

breaking[stable28] fix(manager): removed dead code

feature[stable28] Replace input filed with password field and added password error message

feature[stable28] feat(setupcheck): Add setup check for maintenance_window_start config

feature[stable28] fix(theming): Add adjusted color versions of default background

feature[stable28] fix(files): allow silent batch actions errors

feature[stable28] enh(files): added ability to escape out of all selection when focused

feature[stable28] fix(files): Allow Ctrl/Command click on file entries to open in a new tab

breaking[stable28] enh(breadcrumbs): removed unnecessary aria label

feature[stable28] AppAPI: allow to bypass Two-Factor

fix[stable28] fix(ViewController): Properly handle non-existent fileIds (regression lead to 500 errors)

feature[stable28] fix(dav): allow multiple organizers if possible

feature[stable28] fix(files_external): add back js config files

breaking[stable28] enh(settings): removed background-gradient to ensure contrast ratio a…

feature[stable28] fix(files): add visible label to webdav URL in settings

breaking[stable28] fix(files): remove focus outline on file list item click and make the link focusable

fix[stable28] fix(files): Fix unresponsive file click to download

feature[stable28] feat(user_status): Add online status type for OpenAPI

fix[stable28] fix(weather_status): Fix forecast format in OpenAPI

fix[stable28] fix(files): fix unshare action and merge duplicate shares

feature[stable28] enh(comments): Add visual labels for editor

fix[stable28] fix(dav): Fix user status "Undefined array key 0 at StatusService.php…

feature[stable28] Add RichObject support for SetupCheck descriptions

fix[stable28] Fix crash of login in case of duplicated group membership

feature[stable28] fix(l10n): Add context note for table footers

feature[stable28] enh(settings): Add SetupCheck to ensure webserver correctly serves .mjs files

feature[stable28] Migrate setup checks to new SetupCheck API

fix[stable28] fix(files_sharing): fix sharing status indicator side after component…

fix[stable28] chore(theming): fix warning of incorrect NcCheckboxRadioSwitch usage

feature[stable28] Fix/add settings section type attribute

feature[stable28] Setup check migrations to new API

fix[stable28] fix(files): fixed aria-desciption logic for last breadcrumb

feature[stable28] Add OpenAPI scopes

fix[stable28] fix(build): Fix OpenAPI diff on non-default specs

feature[stable28] enh(files): Allow to copy files into same directory

fix[stable28] fix(files): Fix checkbox state semantics

fix[stable28] fix(a11y): Fix avatar menu icon color in dark mode

fix[stable28] fix header inversion bug

fix[stable28] fix(weather_status): Fix location format for OpenAPI

feature[stable28] fix(settings): Allow to connect to local address when checking for .mjs support

security[stable28] fix(security): Update code signing revocation list

+92 more items in the release notes

28.0.1 Dec 24, 2023 Release notes ↗

other[stable28] Comment legacy file_metadata table migrations

other[stable28] fix(dav): Prevent out-of-office event time drifts

other[stable28] enh(settings): Set main page heading

security[stable28] fix(security): Update CA certificate bundle

other[stable28] Wrap metadata generation in try/catch

feature[stable28] fix(files): Conditionally add drag handlers

other[stable28] fix(UnifiedSearch): Drop title prop

feature[stable28] feat(files): add batch support to copy-move

other[stable28] fix(files): navigation exact

feature[stable28] feat(settings): add occ commands to handle admin delegation

other[stable28] fix(a11y): Unified search headings

other[stable28] fix(Users/Quota setting): Prevent floating point value from getting truncated in locales other than english

other[stable28] enh(oauth2): allowed toggling of aria label

other[stable28] fix(dashboard): changed h3 elements to h2

fix[stable28] fix(files): fix download file encoded source

other[stable28] fix(caldav): don't reuse query builder objects

other[stable28] fix(files): Partly revert 32c1aeb and show correct quota again

other[stable28] chore(deps): Bump @nextcloud/upload to 1.0.4

other[stable28] fix: Ensure correct max contrast color is used when blurred background is used

other28.0.1 RC1

other[stable28] fix(joblist): also reset last_run timestamp on updating an existing job

other[stable28] Don't query oc_properties for metadata props

feature[stable28] fix(ooo): add new ooo status with new emoji

feature[stable28] Add global accessibility switch

other[stable28] Use FileInfo's metadata for hidden prop

other[stable28] fix(userstatus): set user status to 'In a meeting' if calendar is busy

other[stable28] Update crl after revoke rides.csr

other[stable28] fix(dav): undeclared $cache property

other28.0.1

28.0.0 Dec 12, 2023 Release notes ↗

securityFixes CVE-2024-22403: Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any t…

other[stable28] fix rename on live photos

other[stable28] fix(dav): Prevent out-of-office event time drifts

otherRevert "[stable28] fix(dav): Prevent out-of-office event time drifts"

other28.0.0

27.1.11 Jun 25, 2024 Release notes ↗

fixfix: Return a file element even if the rendered list does not contained one

other[stable27] feat: Limit email input to 255 chars

other[stable27] Expose subscription calendars

fix[stable27] fix(dav): Add occ command to fix missing caldav sync tokens

other[stable27] CalDAV fix search with limit and time range

other[stable27] fix(session): Do not update authtoken last_check for passwordless

feature[stable27] fix(contactsinteraction): Allow vCard download

feature[stable27] fix(groups): allows to save group names with more than 64 characters

other[stable27] Avoid updating the same oc_authtoken row twice

other[stable27] perf(db): Sort data for IN before chunking

other[stable27] fix(core): unsupported browser redirect url

other[stable27] fix(dialogs): Make sure conflict dialog is loaded before adding conflicts

feature[stable27] fix(dav): Add retention time to sync token cleanup

other[stable27] fix: Mark more configs as sensitive

feature[stable27] feat: add request id as comment to all queries

other[stable27] fix(sharing): Avoid (dead)locking during orphan deletion

other[stable27] fix(caldav): automatically delete outdated scheduling objects

other[stable27] unmark deleted users if their last login date is more recent than deleted date

other[stable27] fix: forbid moving a folder into a subfolder of itself

fix[stable27] fix: Fix truncation on public page

other[stable27] fix(dav): Rate limit address book creation

other[stable27] fix(dav): Don't log access control as error

other[stable27] ci(eol): update workflow from template

other[stable27] fix: Autodetect legacy filekey instead of trusting the header for legacy header

other[stable27] fix: failing tests for setup check

otherManual/backport/44910/stable27

other[stable27] Update psalm-baseline.xml

other[stable27] fix(caldav): event links in shared calendar notifications

fixfix(ShareEntryLinkedList): Correctly propagate share data

other[stable27] fix(Session): avoid password confirmation on SSO

other[stable27] Use isRetryable to catch retryable exceptions

fix[stable27] fix(ObjectStore): Fix regression when hostname is empty

feature[stable27] test: add tests for ProfilePageController

other[stable27] get child ids for folder in a separate query during move

other[stable27] fix(cron): Log long running jobs

feature[27] feat: add option to disable scanner transactions

other[stable27] Fix npm audit

other27.1.11 RC1

other[stable27] fix(deleteAction): Bump up delete requests concurrency to 5

feature[stable27] fix(Token): add FILESYSTEM scope with SCOPE_SKIP_PASSWORD_VALIDATION

+5 more items in the release notes

27.1.9 Apr 25, 2024 Release notes ↗

other27.1.9

27.1.8 Mar 28, 2024 Release notes ↗

featureAdd "-i" to sendmail's pipe (server#43789)

featureAdd pick plain text files string to be translated (text#5534)

featureAdd some recrusive detection/prevention (server#44321)

featureDo not create a new version for empty files (server#43931)

featureFeat(share): save date and time for expiration (server#43832)

fixFix: Allow to disable multipart copy on external s3 storage (server#43815)

fixFix: Avoid clear cache with prefix (server#44079)

fixFix: Avoid race condition that may initialize a document twice on the clients (text#5479)

fixFix: avoid scanning a non existing directory (server#44206)

fixFix: cypress (viewer#2221)

fixFix: don't return null for SharedStorage::getWrapperStorage with share recursion (server#44415)

fixFix: ensure nested mount points are handled in the correct order (server#44284)

fixFix: fallback from guessing the owner from path in versioning (server#44247)

fixFix: Fetch custom app store url without internet connection (server#43986)

fixFix: filerobot-image-editor (viewer#2250)

fixFix: No password set for new mail shares (server#44193)

fixFix: select the correct table based on CALENDAR_TYPE_CALENDAR (server#43799)

fixFix: Throw instead of yielding nothing when listing local directories (server#43830)

fixFix(ActionInsertLink): Sync NcActionInput value property (text#5426)

fixFix(api): Ignore "parsed" link and icon urls when deleting (notifications#1860)

fixFix(attachments): Don't use currentSession for fetching attachments (text#5485)

fixFix(backend): Accept pushs with only step1 messages by read-only clients (text#5472)

fixFix(caldav): add EXDATE and EXRULE to confidential object (server#44385)

fixFix(comments): move new comment instructions placeholder to description (server#44171)

fixFix(config): Make sure user keys are strings (server#44337)

fixFix(core): Convert text to path in f-droid banner SVG (server#43863)

fixFix(cypress): introduce cypress-split (viewer#2220)

fixFix(cypress): sharing download test (viewer#2224)

fixFix(dav): ACLs for shared addressbooks (server#44378)

fixFix(dav): fallback realm for HTTP authentication (server#43798)

fixFix(federatedfilesharing): Use correct language file to render notifi… (server#44312)

fixFix(files_sharing): ShareesAPI - Return empty response when user is not allowed to share (server#44229)

fixFix(IUrlGenerator): Add throws documentation for imagePath function (server#43977)

fixFix(LinkPicker): Don't open link picker inside code blocks (text#5493)

fixFix(mail): Use parsed action label in email notification (notifications#1842)

fixFix(MarkdownContentEditor): Respect onLoaded callback passed via API (text#5525)

fixFix(session): Fix setting a guest name (text#5474)

+19 more items in the release notes

27.1.7 Mar 1, 2024 Release notes ↗

other[stable27] chore: Update @nextcloud/router to 2.2.1

other[stable27 ONLY] fix(trashbin) Switch parseWebdavPermissions->davParsePermissions

other[stable27] handle storage not available when expiring versions

other[stable27] Buffer chunked requests

other[stable27] fix(Request): Catch exceptions in isTrustedProxy

other[stable27] Fix: config param 'overwritecondaddr' not working

fixfix: Update @nextcloud/dialogs to 4.2.4 to include missing translations

other[stable27] Roll back erroneous nextcloud/files update

other[stable27] Consider admin defaults when creating shares

other[stable27] make failure to load app commands non-fatal

security[stable27] fix(security): Update code signing revocation list

other[stable27] continue background scanning different storages if one fails

fix[stable27] fix: Fix resolved nextcloud/files dep version and user quota parsing

other[stable27] fix(files): Don't attempt to format a partial cache entry

other[stable27] dont reuse etag for folders marked explicitly unscanned

other[stable27] do not break personal settings page is viewer is not there

fix[stable27] Fix for previews not being generated sometimes

other[stable27] fix kerberos test successfull authentication detection

other[stable27] Lower failed movie preview generation logs to level info

other[stable27] fix: make cancelOperation public

feature[stable27] SMB: allow to list root directory when using case-insensitive option

other[stable27] fix(sharing): Move video verification option to password and hide without Talk

other[stable27] Tooltip outside click, should abort share creation

other[stable27] Handle error in previews for files versions

feature[stable27] fix: Add bruteforce protection to email endpoint

other27.1.7 RC1

breaking[stable27] chore: Remove old theming migration steps as they are only needed once

other[stable27] perf: skip request without read permission

other[stable27] Stop the auto-logout loop after redirecting to the logout page

feature[stable27] fix: Add bruteforce protection to federation endpoint

other[stable27] fix(dav): report status

deprecated[stable27] Move away from deprecated utf8_encode() on PHP 8.2+

security[stable27] fix(security): Describe occ security:bruteforce:attempts accurately

other[stable27] Fix undefined share object during expirationDate update

other[stable27] Check share status when touching versions

other[stable27] fix(dav): Rate limit calendar/subscription creation

other[stable27] fix(session): Log when crypto session data is lost

feature[stable27] fix: checkbox now allows shift-click and multi-select

other[stable27] Update @nextcloud/dialogs

+5 more items in the release notes

27.1.6 Jan 25, 2024 Release notes ↗

other[stable27] fix(caldav): don't reuse query builder objects

other[stable27] Update crl after revoke rides.csr

other[stable27] fix: Ensure app menu entries and dashboard welcome message have enough contrast

other[stable27] Don't write back .htaccess file on a RO filesystem

other[stable27] Update psalm-baseline.xml

feature[stable27] AppAPI: allow to bypass Two-Factor

other[stable27] fix(LDAP): ensure stored groups are formatted as simple list

feature[stable27] fix(dav): allow multiple organizers if possible

other[27] restore shared lock ttl to previous value when releasing

other[stable27] only do a multipart s3 copy when above the regular copy limit

other[stable27] fix(files): service worker

other[stable27] perf: Use more performant way to obtain and check the email as a login name with token login

other[stable27] fix: Always apply fullscreen styling to sidebar

other[stable27] fix(share): use user timezone to parse share expiration date

other[stable27] fix: handle exif metadata read errors gracefully

other[stable27] fix(i18n): Changed grammar

other[stable27] fix(appstore): Only send subscription keys to valid appstores

fixfix(files): Fix reference picker not working

other[stable27] fix: reduce memory consumption of scans

other[stable27] (dashboard): Lower error to info log message

other[stable27] fix(manifest): Check if app exists instead of accessing null as an array

other[stable27] fix(systemreport): Mark more configs as sensitive

other[stable27] Update crl after revoke integration_homeassistant.csr

other[stable27] fix(session): Avoid useless authtoken DB queries for anonymous requests

fix[stable27] Fix some silent share bugs

other[stable27] fix(CalDAV): set acls for DeletedCalendarObjectsCollection

other[stable27] fix(Users/Quota setting): Prevent floating point value from getting truncated in locales other than english

other[stable27] Improve path resolution in files_version hooks

other27.1.6 RC1

fix[stable27] fix(auth): Fix logging in with email and app password

other[stable27] Make OAuth2 authorization code expire

other27.1.6 RC2

security[stable27] fix(security): Update code signing revocation list

other27.1.6

27.1.5 Dec 14, 2023 Release notes ↗

other[stable27] fix: lower threshold for system address book sync

other[stable27] fix: Also cleanup orphaned shares user cannot be found anymore

other[stable27] fix(dav): Avoid date diffing if PHP is buggy

other[stable27] fix: Avoid triggering a defered sidebar open if openFile is already handling that

other[stable27] fix(scheduling): don't send iMIP emails to rooms / resources

fix[stable27] fix(files_sharing): fix sharing tab translations

other[stable27] reuse sharing disabled state when listing folder content

other[stable27] do not write htaccess file if disk space is too low

other[stable27] fix(files_versions): Check for user and owner before call getUserFolder

fixfix(ui): Do not close all menus on right click

otherNextcloud 27 : Replace "Update" with "Edit" in share dialog

other[stable27] Improve share logic for enforced password & expiry date

other[stable27] fix(TemplateManager): Bail early if templatedirectory is empty

other[stable27] Fix/text processing types covariant stable27

securityfix(security): Update expiration date in security.txt

other[stable27] Serve .flac audio files

fix[stable27] fix: Fix linkToOCSRouteAbsolute() without index.php and with subfolder

other[stable27] fix: Delete ghost versions of non-existing files

security[stable27] fix: Show error message when CSRF check fails at login

feature[stable27] feat(LDAP): implement IIsAdmin interface

fixfix: Update @nextcloud/dialogs to 4.2.2 to fix translations of FilePicker

breaking[stable27] fix(backupcodes): Remove old notifications before creating a new remi…

other[stable27] Fix root mounts not being setup in some cases

other[stable27] fix(systemreport): Mask onlyoffice secret as sensitive

other[stable27] fix: Properly fetch version from shared files by accessing the owner storage version

other[stable27] fix(updatecheck): Don't wait 120s for a response of updater.nextcloud…

other[stable27] fix(bruteforce-protection): Don't throw a 500 when MaxDelayReached is…

security[stable27] fix(security): Handle idn_to_utf8 returning false

other[stable27] Fix AppSettingsController.php overwriting currentLanguage

fixfix(dist): assets were not compiled

other27.1.5 RC1

security[stable27] fix(security): Update CA certificate bundle

other27.1.5

27.1.4 Nov 23, 2023 Release notes ↗

securityFixes CVE-2023-49791: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to version…

securityFixes CVE-2023-49792: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to version…

other[stable27] fix(isLegitimatedForUserId): Setup mountpoints to check file access

other[stable27] Fix version number in ITimeFactory after it was delayed

fix[stable27] fix(login): Fix JS error on login grant page

feature[stable27] Allow share expiry dates lower than enforced limits

other[stable27] Don't pass invalid streams to Imaginary

other[stable27] fix: Don't try to access null array

otherchore(deps): bump davclient.js from 0.2.1 to 0.2.2

other[stable27] fix(files): race condition on web files view change

feature[stable27] fix: add index on migration only if needed

other[stable27] fix(OCM): Make the public API only rely on OCP

other[stable27] fix semaphore unguarding

other[stable27] fix(files_external): on case insensitive system, block case change

other[stable27] fix(ldap): store last known user groups

other[stable27] Return correct status if touch failed

other[stable27] fix(install): Make installing more verbose

other[stable27] optimize cache jail creation

other[stable27] fix(JobList#hasReservedJob): Break tie when multiple jobs are reserved

other[stable27] fix(LDAP): prevent incomplete displaynames…

other[stable27] fix(log): Log exception class when message is empty

other[stable27] fix(workflowengine): use andWhere() not second where()

fix[stable27] fix(workflow): Fix "Call to a member function getUID() on null" with …

fixfix: encode uri for trashbin delete (the second one)

other[stable27] fix(twofactor): avoid DB error on Twofactor (en/dis)abled event

other[stable27] LDAP: Increase profile picture limit to 512

other[stable27] fix(sharing): set name to target name in sharing cache

other[stable27] Catch Imaginary processing errors

other[stable27] fix(session): Log why session renewal failed

other[stable27] get children from dav node when preloading system tags

other[stable27] fix: Validate that we have a proper distributed cache configured

other[stable27] Lower log level about invalid session token

other[stable27] fix(files): prevent redirect on heading column sort

other[stable27] fix(dav): Reduce CalDAV backend memory footprint

other[stable27] fix(s3): support SSE-C headers for the MultipartCopy call

other[stable27] Finish password confirmation

other[stable27] Reverse X-Forwarded-For list to read the correct proxy remote address

other[stable27] Fix: duplicating contacts with the Recently contacted feature

other[27] optimize builtin storage wrappers

feature[stable27] add some support for rename on case insensitive local filesystems

+8 more items in the release notes

27.1.3 Oct 28, 2023 Release notes ↗

securityFixes CVE-2023-48239: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in…

securityFixes CVE-2023-48301: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud E…

securityFixes CVE-2023-48302: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud E…

fixFix: Escape group names for LDAP (server#37201)

fixFix(updatenotification): Skip update check (server#39826)

fixFix: Avoid failing with duplicate checks (server#40383)

featureAdd wrapper for external storage to ensure we don't get an mtime that is lower than we know it is (server#40569)

otherClear progress bar text when hiding it (server#40572)

otherUse multipart copy for s3 (server#40577)

featureEnh(a11y): Add label to share note textbox (server#40681)

fixFix(unifiedsearch): Allow searching for "0" (server#40683)

fixFix Dashboard IManager getWidgets return annotation (server#40695)

fixMultiple bug fix in users list (server#40718)

fixFix: Escape group names for LDAP (server#40739)

featureUpdates to new sharing flow (server#40747)

fixFix: encode uri for trashbin delete (server#40757)

featureFeat: Add occ user:user:sync-account-data for updating oc_accounts information from user backends (server#40759)

fixFix(files): Show correct quota size (file size base 2) (server#40787)

fixFix(user): Log affected user of app token login name mismatch (server#40797)

featureAdded CORS skip if session was created by AppAPI (server#40830)

otherGenerate all preview sizes for Imaginary (server#40834)

fixFixed mixed translations in sharing details (server#40837)

fixFix: Log critical session renewal and logout paths (server#40849)

breakingRemove leading slash (server#40856)

featureAdd in:users as a search filter to limit searches to users (server#40882)

otherUpdate version.php to owncloud 10.13 (server#40987)

fixFix(external): Get storage before update it (server#41124)

fixFixes and additions to editor API (text#4838)

featureEnh(editorApi): Introduce editor API version number (text#4841)

fixFix(editorApi): Use attachment resolver in MarkdownContentEditor (text#4845)

fixFix(paste): paste plaintext with separate paragraphs (text#4879)

27.1.2 Oct 5, 2023 Release notes ↗

other[stable27] ocm services

other[stable27] chore: Update @nextcloud/dialogs to 4.2.1

feature[stable27] Let occ trashbin:restore restore also from groupfolders and add filters

other[stable27] Revert change that made OC.Util.humanFileSize return decimal sizes instead of binary

other[stable27] Store size in int|float for 32bit support

other[stable27] Fix jsunit tests

other[stable27] Use proper app id in Version.vue

other[stable27] fix: encode uri for trashbin delete

other[stable27] fix(dav): expand recurrences when searching

other27.1.2 RC1

other[stable27] fix ocm-provider rewrite rules

other27.1.2

27.1.1 Sep 21, 2023 Release notes ↗

fix[stable27] fix(mimetype): Fix aborted transaction on PostgreSQL when storing mimetype

other[stable27] Backport consider link shares in removeShare method in SharingTab #40440

other[stable27] don't preload metadata for the sub-childen

other[stable27] fix: don't use davtags for tag search

other[stable27] fix: use faster method to fetch user count

other[stable27] SFTP improvements

other[stable27] fix(comments): Use provided offset in best effort when loading comments

other[stable27] Fix alignments for share different share entry types.

other[stable27] fix: content info footer on guest pages

other[stable27] Consider share type for enforced share expiry dates

feature[stable27] Auto set password for new email shares

other[stable27] Fix issues where unencrypted_size was being falsely used for non-encrypted home folders

other27.1.1

27.1.0 Sep 16, 2023 Release notes ↗

securityFixes CVE-2023-48306: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in…

securityFixes CVE-2023-48304: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in…

securityFixes CVE-2023-48305: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud E…

securityFixes CVE-2023-48303: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud E…

other[stable27] expose gps data via webdav

other[stable27] feat(HTTPClient): Provide wrapped access to Guzzle's asyncRequest()

other[stable27] feat: File reminders backend

other[stable27] fix(3rdparty): Revert accidental 3rdparty bump

other[stable27] The almighty text processing PR

other[stable27] Support opening and comparing versions in viewer

other[stable27] feat(caldav): linkify location in scheduling mails

other[stable27] log imaginary errors as info to not spam the server logs

other[stable27] feat: Set file reminders

other[stable27] fix: Pass proper viewer filename

other[stable27] enh(files_reminders): Adjust reminder options

other[stable27] Vue based FilePicker

other[stable27] Update @nextcloud/dialogs for FilePicker design fixes

other[stable27] AppEcosystem Authentification

other[stable27] Show supported apps on app settings if subscribed

breaking[stable27] fix(notifications): Remove share notification when the node is deleted

feature[stable27] Add l10n for files_reminders

fix[stable27] Fix various file reminders bugs

feature[stable27] Fix smart picker integration of new Vue based file picker

feature[stable27] adjust add button

fix[stable27] try to fix regression with public file upload button

fix[stable27] fix(memcache): Fix comparison of Memcache configs to classes

fix[stable27] fix(files): Fix legacy files list sorting

feature[stable27] feat(dashboard): implement widget item api v2

security[stable27] fix(security): Update CA certificate bundle

security[stable27] feat(security): Add a bruteforce protection backend base on memcache

feature[stable27] allow to upgrade from 26.0.x to 27.1.x directly

fixfix(theming): Add webpack_nounce to support async chunks

deprecated[stable27] fix(utility): De- deprecate getDateTime and getTime as now() only returns DateTimeImmutable

breaking[stable27] fix(cache): Remove displayname cache entry on delete

feature[stable27] fix(CI): Add empty eslint and node when unrelated (PHP only)

feature[stable27] feat: add switch to disable dns pinning

fix[stable27] fix(s3): fix handling verify_bucket_exists parameter

feature[stable27] fix(CardDAV): allow disabling of the system address book

feature[stable27] feat: Add events for version restore

feature[stable27] Backport Polish new sharing flow : accesibility, expand bahavior, click outside behaviour

+67 more items in the release notes

27.0.2 Aug 14, 2023 Release notes ↗

27.0.1 Jul 20, 2023 Release notes ↗

27.0.0 Jun 13, 2023 Release notes ↗

26.0.13 Mar 28, 2024 Release notes ↗

otherCircles' activity (circles#1524)

otherCleanup versions entities in versions:clean command (server#44035)

otherCollaboration, MailPlugin: Protect access to a potentially missing array component by ??. (server#43902)

otherDocs(config.sample.php): Warn that updatedirectory will break updates if set to a value within the installation folder (server#44166)

featureFeat(share): save date and time for expiration (server#43831)

fixFix: Avoid clear cache with prefix (server#44078)

fixFix: ensure nested mount points are handled in the correct order (server#44283)

fixFix: Throw instead of yielding nothing when listing local directories (server#43829)

fixFix(api): Ignore "parsed" link and icon urls when deleting (notifications#1861)

fixFix(caldav): add EXDATE and EXRULE to confidential object (server#44384)

fixFix(config): Make sure user keys are strings (server#44338)

fixFix(mail): Use parsed action label in email notification (notifications#1841)

fixFix(settings): posix_getpwuid can return false which should not be accessed like an array (server#44180)

fixFix(share): use share owner to get ownership (server#44348)

fixFix(Tables): require at least one cell in the header (text#5468)

fixFix(UpdateNotifications): Handle numeric user ids (server#44100)

fixFix(user_ldap): Early failure for empty password login attempt (server#44054)

fixFix(workflowengine): Use correct event names to make search for groups work again (server#44387)

fixFixes for getting the filename in the FileInfo class (server#44199)

otherForbid tagging readonly files (server#44308)

otherImprove files version listing (server#44006)

otherOnly cleanup orphaned shared daily (server#43836)

otherTests(dav): Add unit test for no calendars/subscription limit (server#44156)🪦

26.0.12 Mar 1, 2024 Release notes ↗

other[stable26] Improve path resolution in files_version hooks

other[stable26] handle storage not available when expiring versions

fix[stable26] Fix for previews not being generated sometimes

other[stable26] Buffer chunked requests

security[stable26] fix(security): Update code signing revocation list

other[stable26] continue background scanning different storages if one fails

feature[stable26] SMB: allow to list root directory when using case-insensitive option

other26.0.12 RC1

feature[stable26] fix: Add bruteforce protection to email endpoint

other[stable26] perf: skip request without read permission

other[stable26] Stop the auto-logout loop after redirecting to the logout page

feature[stable26] fix: Add bruteforce protection to federation endpoint

other[stable26] Check share status when touching versions

other[stable26] fix(dav): Rate limit calendar/subscription creation

other[stable26] fix(files): Don't attempt to format a partial cache entry

other26.0.12rc2

other[stable26] Init ViewOnlyPlugin after auth

other26.0.12

26.0.11 Jan 25, 2024 Release notes ↗

other[stable26] Update crl after revoke rides.csr

other[stable26] fix(LDAP): ensure stored groups are formatted as simple list

feature[stable26] fix(dav): allow multiple organizers if possible

other[26] restore shared lock ttl to previous value when releasing

other[stable26] perf: Use more performant way to obtain and check the email as a login name with token login

other[26] actually throttle restore

other[stable26] fix semaphore unguarding

other[stable26] fix: handle exif metadata read errors gracefully

other[stable26] fix(appstore): Only send subscription keys to valid appstores

other[stable26] fix(systemreport): Mark more configs as sensitive

other[stable26] fix(manifest): Check if app exists instead of accessing null as an array

other[stable26] Update crl after revoke integration_homeassistant.csr

other[stable26] fix(session): Avoid useless authtoken DB queries for anonymous requests

other[stable26] fix(CalDAV): set acls for DeletedCalendarObjectsCollection

other[stable26] fix(share): use user timezone to parse share expiration date

other[stable26] fix undefined method getExtStorageHome()

other26.0.11 RC1

fix[stable26] fix(auth): Fix logging in with email and app password

other[stable26] Make OAuth2 authorization code expire

other26.0.11 RC2

security[stable26] fix(security): Update code signing revocation list

other26.0.11

26.0.10 Dec 14, 2023 Release notes ↗

fix[stable26] ci(acceptance): fix dev branch

other[stable26] fix: Also cleanup orphaned shares user cannot be found anymore

other[stable26] fix(dav): Avoid date diffing if PHP is buggy

fix[stable26] fix: Fix linkToOCSRouteAbsolute() without index.php and with subfolder

other[stable26] fix(TemplateManager): Bail early if templatedirectory is empty

security[stable26] fix(security): Update expiration date in security.txt

other[stable26] fix(ui): Do not close all menus on right click

other[stable26] fix(systemreport): Mask onlyoffice secret as sensitive

other[stable26] fix(updatecheck): Don't wait 120s for a response of updater.nextcloud…

security[stable26] fix(security): Handle idn_to_utf8 returning false

other[stable26] SFTP improvements

other[stable26] fix(bruteforce-protection): Don't throw a 500 when MaxDelayReached is…

other[stable26] Fix root mounts not being setup in some cases

other[stable26] fix(sharing): set name to target name in sharing cache

other26.0.10 RC1

security[stable26] fix(security): Update CA certificate bundle

other26.0.10

26.0.9 Nov 23, 2023 Release notes ↗

other[stable26] fix(isLegitimatedForUserId): Setup mountpoints to check file access

other[stable26] fix: Don't try to access null array

fix[stable26] chore(deps): fix package-lock.json

other[stable26] Fix download URL for versions

other[stable26] fix(files): race condition on web files view change

other[stable26] fix(session): Log why session renewal failed

other[stable26] fix(OCM): Make the public API only rely on OCP

other[stable26] fix(files_external): on case insensitive system, block case change

other[stable26] Return correct status if touch failed

other[stable26] fix(ldap): store last known user groups

other[stable26] optimize cache jail creation

otherBump sabre/http to 5.1.10 in stable26

other[stable26] Fix type in BeforeMessageLoggedEvent

other[stable26] fix: Validate that we have a proper distributed cache configured

fix[stable26] fix(workflow): Fix "Call to a member function getUID() on null" with …

other[stable26] fix(log): Log exception class when message is empty

other[stable26] Catch Imaginary processing errors

other[stable26] fix(workflowengine): use andWhere() not second where()

other[stable26] fix(LDAP): prevent incomplete displaynames…

breaking[stable26] fix(backupcodes): Remove old notifications before creating a new remi…

other[stable26] fix(twofactor): avoid DB error on Twofactor (en/dis)abled event

other[stable26] LDAP: Increase profile picture limit to 512

other[stable26] Don't pass invalid streams to Imaginary

other[stable26] Lower log level about invalid session token

other[stable26] Show proper warning on 0 quota

other[stable26] fix: Delete ghost versions of non-existing files

other[stable26] fix(files): prevent redirect on heading column sort

fix[stable26] fix(login): Fix JS error on login grant page

other[stable26] Finish password confirmation

other[stable26] Reverse X-Forwarded-For list to read the correct proxy remote address

feature[stable26] add some support for rename on case insensitive local filesystems

other[stable26] Update psalm-baseline.xml

other26.0.9 RC1

other[stable26] fix(files_versions): don't call getUid() on null

otherRevert "[stable26] fix(files_versions): don't call getUid() on null"

other26.0.9

26.0.8 Oct 28, 2023 Release notes ↗

fixFix: Escape group names for LDAP (server#37201)

featureAdd commands for basic file actions (server#38250)

fixFix unencrypted_size for folders when scanning the filesystem with encryption enabled (server#38555)

otherEmit an event when a message is logged (server#38815)

otherEnable download configuration on circles shares (server#40303)

fixFix(autoloader): no apcu no side effects (server#40351)

fixFix(ldap): avatar is not being fetched (server#40370)

fixFix: Avoid failing with duplicate checks (server#40384)

otherOcm services (server#40592)

otherDo not throw while restoring unloaded files list entries (server#40606)

fixFix(dav): expand recurrences when searching (server#40632)

otherUse proper app id in Version.vue (server#40641)

fixFix(unifiedsearch): Allow searching for "0" (server#40684)

fixFix Dashboard IManager getWidgets return annotation (server#40694)

fixFix: Escape group names for LDAP (server#40740)

fixFix ocm-provider rewrite rules (server#40781)

fixFix(user): Log affected user of app token login name mismatch (server#40798)

otherClear progress bar text when hiding it (server#40846)

fixFix: Log critical session renewal and logout paths (server#40851)

breakingRemove leading slash (server#40862)

featureAdd in:users as a search filter to limit searches to users (server#40883)

otherUpdate version.php to owncloud 10.13 (server#40989)

fixFix(external): Get storage before update it (server#41125)

fixFix(db): also chunk MariaDB deletes (activity#1313)

fixFixes and additions to editor API (text#4839)

featureEnh(editorApi): Introduce editor API version number (text#4842)

fixFix(editorApi): Use attachment resolver in MarkdownContentEditor (text#4848)

fixFix(paste): paste plaintext with separate paragraphs (text#4880)

26.0.7 Sep 21, 2023 Release notes ↗

feature[stable26] Add version sidebar events

other[stable26] Fix issues where unencrypted_size was being falsely used for non-encrypted home folders

other[stable26] fix: don't use davtags for tag search

feature[stable26] fix(caldav): add webroot to objectid for activities

other[stable26] Hide shares by disabled users

other[stable26] fix(comments): Use provided offset in best effort when loading comments

other26.0.7

26.0.6 Sep 14, 2023 Release notes ↗

securityFixes CVE-2023-45148: Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier th…

26.0.5 Aug 14, 2023 Release notes ↗

26.0.4 Jul 20, 2023 Release notes ↗

securityFixes CVE-2023-39963: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9…

securityFixes CVE-2023-39962: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.…

securityFixes CVE-2023-39958: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, m…

securityFixes CVE-2023-39960: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server st…

securityFixes CVE-2023-39959: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a…

securityFixes CVE-2023-39961: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an ima…

26.0.3 Jun 22, 2023 Release notes ↗

securityFixes CVE-2023-45151: Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially…

securityFixes CVE-2023-39952: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a…

26.0.2 May 25, 2023 Release notes ↗

securityFixes CVE-2023-35172: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 an…

securityFixes CVE-2023-32320: Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty req…

securityFixes CVE-2023-35928: Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Ser…

securityFixes CVE-2023-35927: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 an…

securityFixes CVE-2023-35171: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could s…

securityFixes CVE-2024-37314: Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud…

26.0.1 Apr 20, 2023 Release notes ↗

26.0.0 Mar 21, 2023 Release notes ↗

25.0.13 Oct 28, 2023 Release notes ↗

featureAdd commands for basic file actions (server#38251)

fixFix: always use display name from correct backend (server#39992)

otherCalendar optimizations (server#40290)

fixFix(ldap): avatar is not being fetched (server#40371)

fixFix: Avoid failing with duplicate checks (server#40385)

otherDo not throw while restoring unloaded files list entries (server#40610)

fixFix(dav): expand recurrences when searching (server#40635)

fixFix(unifiedsearch): Allow searching for "0" (server#40685)

fixFix Dashboard IManager getWidgets return annotation (server#40693)

otherClear progress bar text when hiding it (server#40847)

featureAdd in:users as a search filter to limit searches to users (server#40884)

otherUpdate version.php to owncloud 10.13 (server#40988)

fixFix(external): Get storage before update it (server#41126)

fixFix(db): also chunk MariaDB deletes (activity#1314)

fixFix(settings): browser freeze when picking photos directory (photos#2061)

fixFix(paste): paste plaintext with separate paragraphs (text#4878)

25.0.12 Sep 21, 2023 Release notes ↗

25.0.11 Sep 14, 2023 Release notes ↗

25.0.10 Aug 14, 2023 Release notes ↗

25.0.9 Jul 20, 2023 Release notes ↗

25.0.8 Jun 22, 2023 Release notes ↗

25.0.7 May 25, 2023 Release notes ↗

25.0.6 Apr 20, 2023 Release notes ↗

securityFixes CVE-2023-32318: Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cooki…

25.0.5 Mar 23, 2023 Release notes ↗

securityFixes CVE-2023-32319: Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the p…

securityFixes CVE-2023-30539: Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are syste…

securityFixes CVE-2023-28847: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server…

25.0.4 Feb 23, 2023 Release notes ↗

securityFixes CVE-2023-26482: Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administr…

securityFixes CVE-2023-28844: Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled…

securityFixes CVE-2023-25818: Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations…

securityFixes CVE-2023-25820: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud…

securityFixes CVE-2023-28834: Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server 23.0.0 until 23.0.11, 24.0.0 until 24.…

securityFixes CVE-2023-28835: Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when…

securityFixes CVE-2023-28833: Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted an…

25.0.3 Jan 17, 2023 Release notes ↗

securityFixes CVE-2023-28644: Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denia…

securityFixes CVE-2023-28643: Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will r…

securityFixes CVE-2023-25816: Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can configure a very long password, consumin…

25.0.2 Dec 8, 2022 Release notes ↗

securityFixes CVE-2023-25579: Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The funct…

25.0.1 Nov 3, 2022 Release notes ↗

25.0.0 Oct 19, 2022 Release notes ↗

24.0.12 Apr 20, 2023 Release notes ↗

24.0.11 Mar 23, 2023 Release notes ↗

24.0.10 Feb 23, 2023 Release notes ↗

24.0.9 Jan 17, 2023 Release notes ↗

securityFixes CVE-2023-25817: Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deleta…

24.0.8 Dec 8, 2022 Release notes ↗

securityFixes CVE-2023-25162: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.…

securityFixes CVE-2023-25161: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missin…

24.0.7 Nov 3, 2022 Release notes ↗

securityFixes CVE-2023-25821: Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shar…

securityFixes CVE-2022-41970: Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and p…

securityFixes CVE-2022-41969: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator…

24.0.6 Oct 6, 2022 Release notes ↗

securityFixes CVE-2022-39330: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versi…

24.0.5 Sep 8, 2022 Release notes ↗

securityFixes CVE-2022-39364: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to ver…

securityFixes CVE-2022-41968: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can se…

securityFixes CVE-2022-39329: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable…

24.0.4 Aug 12, 2022 Release notes ↗

securityFixes CVE-2022-39211: Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nex…

24.0.3 Jul 18, 2022 Release notes ↗

securityFixes CVE-2022-36074: Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade.…

securityFixes CVE-2022-39346: Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing…

24.0.2 Jun 20, 2022 Release notes ↗

securityFixes CVE-2022-31118: Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access t…

24.0.1 May 19, 2022 Release notes ↗

24.0.0 May 5, 2022 Release notes ↗

23.0.12 Dec 8, 2022 Release notes ↗

23.0.11 Nov 3, 2022 Release notes ↗

23.0.10 Oct 6, 2022 Release notes ↗

23.0.9 Sep 8, 2022 Release notes ↗

23.0.8 Aug 12, 2022 Release notes ↗

23.0.7 Jul 18, 2022 Release notes ↗

23.0.6 Jun 20, 2022 Release notes ↗

23.0.5 May 19, 2022 Release notes ↗

securityFixes CVE-2022-31014: Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the bac…

23.0.4 Apr 26, 2022 Release notes ↗

securityFixes CVE-2022-29243: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users…

securityFixes CVE-2022-31120: Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share even…

23.0.3 Mar 24, 2022 Release notes ↗

securityFixes CVE-2022-29163: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if…

23.0.2 Mar 24, 2022 Release notes ↗

23.0.1 Mar 24, 2022 Release notes ↗

securityFixes CVE-2022-24888: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders…

securityFixes CVE-2022-24889: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "…

23.0.0 Dec 3, 2021 Release notes ↗