Nextcloud Server 30.0.14 → 33.0.5
40 releases · 13 breaking changes · 50 security fixes · 1 advisory fixed
50security13breaking3deprecated109feature120fix
Vulnerabilities fixed by this upgrade
- 6.4 CVE-2025-59788 Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…
Breaking changes
- breaking Remove unneeded sort when listing mail/federated shares (server#60356) in 33.0.4
- breaking Debt(files): Remove regular stats request (server#56822) in 33.0.3
- breaking Remove external shares from share list (server#58717) in 33.0.1
- breaking Remove unneeded max-height from text-menubar which caused a bug (text#8351) in 33.0.1
- breaking Chore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718) in 33.0.0
- breaking Remove stable30 from dependabot (server#56018) in 33.0.0
- breaking Debt(files): Remove regular stats request (server#56792) in 33.0.0
- breaking Enhancement(files): remove redundant success toast on file rename (server#57168) in 33.0.0
- breaking Refactor!: migrate files sidebar to Node API (server#57277) in 33.0.0
- breaking Remove custom handling for public share pages with single files (files_pdfviewer#1206) in 31.0.5
- breaking [stable31] test: Remove .only() calls in 31.0.2
- breaking [stable31] fix: remove caching in fetchListOfGroups in 31.0.1
- breaking [stable31] fix(l10n): Remove leading space from translation string in 31.0.1
Security changes
- security Fix(security): Update Expires time (server#60396) in 33.0.4
- security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580) in 33.0.4
- security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 33.0.3
- security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 33.0.3
- security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 33.0.3
- security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 33.0.3
- security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 33.0.3
- security Fix(security): Update Expires time (server#54868) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#54982) in 33.0.3
- security Fix(security): Update code signing revocation list (server#55051) in 33.0.3
- security Fix(security): Update code signing revocation list (server#55445) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#56209) in 33.0.3
- security Fix(security): Update code signing revocation list (server#56365) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#56812) in 33.0.3
- security Fixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the… in 33.0.1
- security Fix(SecurityMiddleware): return header to distinguish error type (server#58880) in 33.0.1
- security [master] fix(security): Update CA certificate bundle (server#54992) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#55056) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#55446) in 33.0.0
- security [master] fix(security): Update CA certificate bundle (server#56211) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#56363) in 33.0.0
- security [master] fix(security): Update CA certificate bundle (server#56811) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57031) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57262) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57380) in 33.0.0
- security Fix(security): Update Expires time (server#57688) in 33.0.0
- security Fix(security): Update code signing revocation list (server#57948) in 33.0.0
- security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 32.0.9
- security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 32.0.9
- security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 32.0.9
- security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 32.0.9
- security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 32.0.9
- security Fixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf… in 32.0.4
- security Fixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica… in 32.0.3
- security Fixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont… in 32.0.3
- security Fixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the… in 32.0.2
- security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 32.0.1
- security Fixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont… in 32.0.1
- security Fixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf… in 31.0.14
- security Fixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica… in 31.0.12
- security Fixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont… in 31.0.12
- security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 31.0.10
- security Fixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont… in 31.0.10
- security Fixes CVE-2025-47790: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3… in 31.0.3
- security Fixes CVE-2025-66547: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via… in 31.0.1
- security Fixes CVE-2025-66552: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app t… in 31.0.1
- security Fixes CVE-2025-47794: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13… in 31.0.1
- security [stable31] fix(security): Update CA certificate bundle in 31.0.1
- security Fix A+ rating when checking with Nextcloud Security Scan. in 31.0.1
- security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 30.0.17
Deprecations
- deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1268) in 33.0.1
- deprecated Port away from deprecated Doctrine APIs (server#55674) in 33.0.0
- deprecated Cleanup unused code and deprecated imports (text#7752) in 33.0.0
Every release in between
otherRefactor: move release changelog workflow to releases repo (server#60831)
fixFix: Add missing DI for IAppConfig to Push.php (notifications#3039)
fixFix(folderDescription): always use ‘Readme.md’ as filename (text#8658)
fixFix(headings): skip headings in details in table of contents (text#8660)
otherTest(playwright): add summary job so we can add it to merge rules (text#8663)
fixFix: allow renaming files with just update permissions (server#59241)
fixFix(encryption): limit oprhaned keys scan to one user (server#59808)
fixFix(s3): ignore prefixes with repeating delimiters (server#59829)
fixFix removed address book items not being synced between federated instances (server#59894)
fixFix(files): fix custom client-side error messages on move/copy actions (server#59954)
featureFeat: Better reporting if something is wrong with taskprocessing (server#59991)
fixFix: Harmonize login and passwordless login redirect behavior (server#60007)
fixFix(core): provide valid initial state also on public templates (server#60015)
fixFix(navigation): Fix default app icon (server#60133)
fixFix(files): escape html entities in dav search requests (server#60140)
fixFix(LocalPreviewStorage): Use correct regex to detect files in nested directory format (server#60143)
fixFix(comments): register event listener for typed comment events (server#60149)
fixFix(core): use btoa() instead of window.Buffer.from() for base64 encoding (server#60157)
fixFix: Dispatch old comment events (server#60168)
fixFix(comments): Add an action to comment notification that dismisses it (server#60175)
fixFix(core): prompt for password once when installing recommended apps (server#60184)
featureFeat(updatenotification): handle files_lock (server#60203)
fixFix(public.scss): increase footer width (server#60208)
fixFix: correct typo ‘occured’ to ‘occurred’ in SetupCheckManager (server#60210)
fixFix since checker (server#60219)
fixFix(settings): Fix admin delegation for hidden sections (server#60222)
fixFix: Fix permission issue when uploading a chunked file (server#60240)
featureFeat(app-licenses): Add further compatible licenses for apps to use (server#60296)
fixFix(Setup): Ensure instanceid is generated during installation (server#60301)
fixFix(http-client): detect brotli support via libcurl, not PHP extension (server#60309)
fixFix(s3): Add Content-MD5 header for DeleteObjects to fix AWS SDK v3.339.0+ compatibility (server#60322)
fixFix(snowflake): fix wrong documentation about serverId (server#60328)
featurePerf(share): Remove useless order by id (server#60345)
breakingRemove unneeded sort when listing mail/federated shares (server#60356)
featurePerf: remove unneeded sort in getFolderContentsById (server#60357)
securityFix(security): Update Expires time (server#60396)
featureFeat(users): Check assertion when enabling user (server#60516)
featureEnh(occ): make it possible to add an arbitrary number of users to a g… (server#60601)
featureFeat(openmetrics): export more resilient if exception happens (server#60627)
featureFeat: add search and limit support for team members list (circles#2460)
featureFeat: Remove unnecessary whitespaces (logreader#2027)
featureFeat(push): Optionally use OAEP padding (notifications#2986)
featurePerf(rich_workspace): only add property for parent (text#8498)
featureFeat: add support for wiki-style link and image Markdown syntax (text#8576)
securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580)
+86 more items in the release notessecurityFixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
securityFixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
securityFixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
securityFixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
securityFixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
featureFeat(migration-attributes): add DataCleansing (server#54861)
featureFeat(SystemTag): Add typed events for tag mapper events (server#54863)
securityFix(security): Update Expires time (server#54868)
featureAdd task processing manager method to get the list of available task type IDs (server#54917)
featureFeat(file_sharing): Provide template creator list in public shares (server#54948)
featureFeat: show object store instance in info:file (server#54961)
featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#54967)
featurePerf(mounts): avoid array_merge in mounts loop (server#54976)
securityFix(security): Update CA certificate bundle (server#54982)
featureFeat(ZipFolderPlugin): always use the parent folder name as archive name (server#55020)
securityFix(security): Update code signing revocation list (server#55051)
featureFeat(encryption): Add integration tests for occ commands and fix them (server#55060)
featureFeat(files_sharing): provide web components based API for sidebar (server#55174)
featureFeat(db): add SSL/TLS support for PostgreSQL (server#55256)
featureFeat(Unified search): Use existing min search length setting (server#55301)
featureFeat: Mark OC.SystemTags as deprecated (server#55323)
featureAdmin-delegation occ – add output option for show command to support JSON formats (server#55430)
securityFix(security): Update code signing revocation list (server#55445)
featureFeat: add header with user id in response (server#55502)
featureAllow to remove a website in the user profile (server#55523)
featureFeat(test-case): allow to use PHPUnit Group attributes to mark tests requiring database (server#55571)
featureFeat(settings): Introduce TaskProcessingSuccessRate setup check (server#55778)
featureFeat: add new link endpoint when using globalscale (server#55798)
featureFeat(route): globalsiteselector as root url generator (server#55817)
featureFeat: locally cache frequently requested LDAP mapping data (server#55823)
featureAdd font-variant-numeric to selected files list (server#55873)
featureAdd unit tests for AdminDelegation command and AuthorizedGroupService (server#56044)
securityFix(security): Update CA certificate bundle (server#56209)
featureFeat(EphemeralSessions): Introduce lax period (server#56232)
featureFeat(cloud-federation-api): accept folder shares (server#56336)
featureFeat: add occ command to scan and delete orphaned keys (server#56347)
securityFix(security): Update code signing revocation list (server#56365)
featureAdd AI input limits (server#56369)
featureFeat(rate-limit): Allow overwriting the rate limit (server#56382)
featureAdd rememberme checkbox (server#56423)
+732 more items in the release notesotherserver
featureFeat(recent-files): add recent_files_limit config on files settings (server#59216)
other33.0.2 RC0 (server#59259)
fixFix(files_sharing): do not prevent share creation if password is enabled but not supported by the current share type (server#59263)
fixFix(sharing): Don’t redirect when accepting a share failed (server#59305)
other33.0.2 RC1 (server#59306)
other33.0.2 (server#59392)
otheractivity
otherChore(branchoff): Set version on stable33 to a stable one (activity#2480)
otherbruteforcesettings
otherChore(branchoff): Set version on stable33 to a stable one (bruteforcesettings#1032)
otherUpdate nextcloud/ocp dependency (bruteforcesettings#1038)
otherfiles_downloadlimit
otherChore(branchoff): Set version on stable33 to a stable one (files_downloadlimit#756)
otherfiles_pdfviewer
otherChore(branchoff): Set version on stable33 to a stable one (files_pdfviewer#1401)
otherfirstrunwizard
otherChore(branchoff): Set version on stable33 to a stable one (firstrunwizard#2020)
otherpassword_policy
otherChore(branchoff): Set version on stable33 to a stable one (password_policy#914)
otherphotos
otherChore(branchoff): Set version on stable33 to a stable one (photos#3459)
otherprivacy
otherChore(branchoff): Set version on stable33 to a stable one (privacy#1289)
otherrecommendations
otherChore(branchoff): Set version on stable33 to a stable one (recommendations#1004)
otherrelated_resources
otherChore(branchoff): Set version on stable33 to a stable one (related_resources#907)
otherserverinfo
otherChore(branchoff): Set version on stable33 to a stable one (serverinfo#967)
othersurvey_client
otherChore(branchoff): Set version on stable33 to a stable one (survey_client#391)
othersuspicious_login
otherChore(branchoff): Set version on stable33 to a stable one (suspicious_login#1092)
othertext
fixFix(deps): update dependency yjs to ^13.6.30 (text#8394)
otherChore(branchoff): Set version on stable33 to a stable one (text#8407)
othertwofactor_totp
otherChore(branchoff): Set version on stable33 to a stable one (twofactor_totp#1751)
fixFix(deps): align composer-lock and checked-in vendor/ (updater#727)
+3 more items in the release notessecurityFixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the…
fixFix(docs): Fix dead documentation link for Windows file names (server#58291)
fixFix(comments): properly handle opening the sidebar when Activity integration is used (server#58294)
fixFix(theming): display error messages on image upload and delete previous image only after validation (server#58323)
fixFix: don’t try to create preview folder if it already exists (server#58328)
fixFix: obey x-nc-scheduling flag on delete (server#58341)
fixFix(sftp): Handle empty port parameter to allow host-defined ports (server#58358)
featureFeat: add upload_time support to file search and recent files (server#58374)
fixFix(files): correctly sort views (server#58375)
fixFix(cache): filter out invalid entries in `OC\Files\Cache\Wrapper\CacheWrapper::getFolderContentsById` (server#58378)
fixFix(setup): add index properties_name_path_user by default on new installs (server#58418)
fixFix(external_storage): hide local storage as an option for users (server#58424)
fixFix(user_status): mount emoji picker outside of dialog (server#58429)
fixFix(perf): use index when deleting old previews (server#58431)
fixFix(Propagator): Skip groupfolders root entries (server#58433)
fixFix/more missing userid cases (server#58440)
fixFix(files_sharing): ensure the server share API errors are shown (server#58441)
fixFix(TransferOwnershipService): Remove groupfolders size (server#58449)
fixFix(Propagator): Also skip groupfolders versions and trash entries (server#58450)
fixFix(View): Handle ICacheEntry returned by FileInfo->getData() (server#58455)
fixFix(files): fix tab navigation from select all checkbox to batch actions (server#58462)
fixFix(files_sharing): make legacy `downloadShare` endpoint compatible with legacy behavior (server#58468)
fixFix(dav): Use an exhaustive list for allowed serialized classes (server#58511)
featureFeat: calendar read and write federation (server#58590)
featurePerf(sharing): Avoid loading all shares from all users when unsharing (server#58658)
featureFeat: set creation_time on file creation and render recently created icon (server#58694)
breakingRemove external shares from share list (server#58717)
featurePerf(preview): bulk process preview regeneration (server#58796)
featureFeat: Add memcache_customprefix (server#58810)
featureFeat(routing): add files_sharing_raw to rootUrlApps (server#58838)
securityFix(SecurityMiddleware): return header to distinguish error type (server#58880)
featureFeat: improve calendar migrator (server#58907)
featureFeat(CalDAV): Add function to get the token of a publicly shared calendar (server#59080)
featureFeat(taskprocessing): add worker command for synchronous task processing (server#59082)
featurePerf: Replace getById call with getFirstNodeById (activity#2388)
featurePerf: add new index to serve a full WHERE clause (activity#2447)
featureFeat: make Docker API version configurable via app config (app_api#798)
featureAvoid cropping logo in About & New slideshow (firstrunwizard#1964)
featureFeat(api): Add context parameter to generate and validate endpoints (password_policy#900)
deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1268)
+137 more items in the release notesfeatureAdd UserConfigChangedEvent to fire whenever a user config value is changed (server#42039)
featureFeat: Add appconfig to disable fixed userfolder permissions optimization (server#51145)
featureFeat: add an option to filter what paths get checked for updates (server#52442)
featureFeat(CertificateManager): Add option to specify the default certificates bundle path (server#52749)
featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#52825)
featureFeat(previews): allow ffmpeg to connect direct for AWS S3 buckets (server#53634)
featureFeat(login): hide password on form submit (server#53869)
featureFeat(previews): previews for large remote files without full file download (server#53952)
featureFeat(encryption): Add integration tests for occ commands and fix them (server#54316)
featureFeat: locally cache frequently requested LDAP mapping data (server#54429)
featurePerf(s3): Provide direct pre-signed download link (server#54436)
featureAdd INodeByPath to Directory (server#54441)
featureFeat(config): Add common audio and video MIME type aliases (server#54447)
featurePerf(preview): Split preview data to new table (server#54543)
featureFeat(file_sharing): Provide template creator list in public shares (server#54565)
featureFeat(comments): add Markdown support (server#54685)
featureFeat(files_sharing): provide web components based API for sidebar (server#54788)
featureFeat(ObjectStore): Add option to limit the total size (server#54797)
featureFeat(SystemTag): Add typed events for tag mapper events (server#54810)
featureFeat(migration-attributes): add DataCleansing (server#54842)
featureFeat(migration-attributes): missing attributes (server#54846)
featureAdd task processing manager method to get the list of available task type IDs (server#54848)
security[master] fix(security): Update CA certificate bundle (server#54992)
security[master] fix(security): Update code signing revocation list (server#55056)
security[master] fix(security): Update code signing revocation list (server#55446)
deprecatedPort away from deprecated Doctrine APIs (server#55674)
breakingChore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718)
breakingRemove stable30 from dependabot (server#56018)
security[master] fix(security): Update CA certificate bundle (server#56211)
security[master] fix(security): Update code signing revocation list (server#56363)
breakingDebt(files): Remove regular stats request (server#56792)
security[master] fix(security): Update CA certificate bundle (server#56811)
security[master] fix(security): Update code signing revocation list (server#57031)
breakingEnhancement(files): remove redundant success toast on file rename (server#57168)
security[master] fix(security): Update code signing revocation list (server#57262)
breakingRefactor!: migrate files sidebar to Node API (server#57277)
security[master] fix(security): Update code signing revocation list (server#57380)
securityFix(security): Update Expires time (server#57688)
securityFix(security): Update code signing revocation list (server#57948)
deprecatedCleanup unused code and deprecated imports (text#7752)
+2364 more items in the release notessecurityFixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
securityFixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
securityFixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
securityFixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
securityFixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
securityFixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…
securityFixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…
securityFixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…
securityFixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the…
securityFixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…
securityFixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont…
securityFixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…
securityFixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…
securityFixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…
securityFixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…
securityFixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont…
featureFeat: add logging to preview generation (server#52300)
featureFeat: handle hide-download DAV property (viewer#2807)
featureFeat: lowercase headers to exclude in exapp proxy (app_api#569)
featureFeat(profile): Add an API to get the profile field data (server#52372)
featureFeat(security): add configurable IPv6 subnet for BFP and throttling (server#52233)
fixFix multiple cypress issues (activity#1994)
fixFix saving annotations in paths with special characters (files_pdfviewer#1194)
fixFix task processing registration validation (app_api#573)
fixFix: Adjust padding in table cell and header components (text#7189)
fixFix: adjust webpack nonce generation (server#52003)
fixFix: Apply storage checks in addition to share (text#7192)
fixFix: Check that user actually can validate password for js (server#52237)
fixFix: don't check node access again for listing reminders in dav (server#52504)
fixFix: don't setup the filesystem to check if a user is blocked by ACLs (activity#1985)
fixFix: exclude vendor-bin from release artifacts (suspicious_login#989)
fixFix: fix preloading files with no custom properties (server#52101)
fixFix: Flaky samba kerberos tests (server#52578)
fixFix: Forward attributes to the sidebar (server#52566)
fixFix: Open PDF file in "richdocuments" if it is not downloadable (files_pdfviewer#1204)
fixFix: Proper order for checking path prefix for getting file by id from cache (server#52039)
fixFix: submit button on file picker dialog (text#7190)
fixFix: Transfer ownership with S3 as primary (server#52185)
fixFix: try to avoid memory exhaustion (suspicious_login#988)
fixFix(apps): Sort names separately from active/update state (server#52653)
fixFix(blurhash): Use preview API to generate the previews (server#52661)
fixFix(build): avoid double load of the app (notifications#2309)
fixFix(CalDAV): do not ignore move command object target uri (server#52562)
fixFix(CI): disable RateLimiting for Nextcloud in the CI (app_api#565)
fixFix(config): Censor more app configs in system report (server#52433)
fixFix(dav): allow uploading of files with long filenames (server#52302)
fixFix(dav): check the owner displayName scope before giving attribute (server#52554)
fixFix(db): Create replacement index where original index is missing (server#52394)
fixFix(exAppMapper): init missing headers_to_exclude (app_api#564)
featurePerf: Log requests using high amount of memory as warning (server#52219)
featurePerf(caldav): increase chunk size in RemoveOrphanEventsAndContacts repair step (server#52548)
featurePerf(cloud_federation_api): only provide capabilities if needed (server#52030)
featurePerf(db): Extend index on cards_properties to cover name and value (server#52415)
featurePerf(files_reminders): Reduce db queries on propfind (server#51736)
featurePerf(files_sharing): do not emit second propfind for account filter (server#52001)
breakingRemove custom handling for public share pages with single files (files_pdfviewer#1206)
+51 more items in the release notesother[stable31] fix(taskprocessing): use the event for AppAPI to get list of AI providers
other[stable31] fix(dav): Really only run the chunk cleanup once
fix[stable31] fix(files_sharing): fix share creation error handling
fix[stable31] feat(bulk-upload): change the default to disabled as there are still some bugs present
other[stable31] fix(federation): Don't load the addressbook when resolving a cloud ID
other[stable31] ignore missing theming app
other[stable31] fix(ContextAgent): Do not translate the name ContextAgent
otherbuild(deps): bump marked from 15.0.7 to 15.0.8
feature[stable31] chore(files_trashbin): Add user details in log from Trashbin
other[stable31] fix: Handle missing share providers when promoting reshares
otherbuild(deps): bump @nextcloud/event-bus from 3.3.1 to 3.3.2
otherbuild(deps): bump dompurify from 3.2.4 to 3.2.5
other[stable31] fix(files_sharing): rate limit share creation 20 times per 10 minutes
other[stable31] fix(files_sharing): Apply default password setting in SharingDetailsTab
other31.0.4 RC1
other31.0.4
securityFixes CVE-2025-47790: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3…
fixFix(files): also show file list headers on empty views (server#51275)
fixFix(dav): Create SAB at installation (server#51316)
fixFix: remote account activity translation (server#51326)
fixFix: Do not build encrypted password if there is none (server#51330)
featureFeat(dav): add webhook compatibility for calendar object events (server#51331)
fixFix disabled user list for SAML group subadmin (server#51376)
fixFix(files_external): Stop building path twice when checking if file exists on case insensitive SMB storage (server#51388)
fixFix(CalDav): alter invitation attachment filename and type (server#51466)
fixFix(files_sharing): ensure share status action works also in grid view (server#51474)
fixFix(profile): allow to unset phone number (server#51511)
fixFix: skip caching lastSeenQuotaUsage for remote shares (server#51522)
fixFix(cardav): only show users from enabled addressBooks in contacts menu (server#51539)
fixFix(unified-search): do not overlap search bar with button (server#51566)
fixFix(webauthn): adjust for updated library and add tests (server#51578)
fixFix: pass hide download attribute while creating the share to fix github issue 50788 (server#51582)
fixFix(files_sharing): skip expiration notify for invalid share record (server#51616)
fixFix(ocm): publicKey can be disabled so capabilities do not match (server#51653)
fixFix(files): Ensure actions never overflow filename (server#51659)
fixFix(IFilenameValidator): correctly handle case insensitivity (server#51662)
fixFix(user): Some strings not being translated (server#51666)
fixFix(provisioning_api): Pass on translated hint if password change fails (server#51672)
fixFix(setupchecks): Treat information messages as success (server#51678)
fixFix(database): Cast users count to integer (server#51688)
fixFix(systemtags): Dispatch events when bulk assigning system tags (server#51690)
featurePerf(sharing): Use oc_share.item_type IN instead of OR equals (server#51691)
fixFix(dav): filter user files when updating tags (server#51693)
fixFix files_sorting cypress tests (server#51695)
fixFix(login): Improve CSRF error message for better user understanding (server#51699)
fixFix public download activity (server#51704)
fixFix: filter out contacts with empty email addresses in sharee completion (server#51708)
fixFix(GenerateBlurhashMetadata): Suppress imagescale errors (server#51718)
fixFix(occ): Suppress errors when checking config.php fileowner (server#51720)
fixFix(files_versions): correctly show version author also for shared files (server#51723)
fixFix(files_reminders): Fix reminder actions being displayed on invalid nodes (server#51738)
featureFeat: Limit ExpireTrash job to 30 minutes (server#51808)
featurePerf(cron): Delay (re)checking timed jobs (server#51820)
featureRevert "refactor: add migration for email setting" (server#51987)
featureFeat(ip): use larger IPv6 range by default (server#52033)
featureFeat: skip expire sharing notify if node deleted (activity#1937)
+57 more items in the release notesother[stable31] fix(mime-types): adjust compiled mime types and sign
other[stable31] fix(encryption): Listen for user login and logout to set encryption key
feature[stable31] Allow to delete files without trashbin + add unit tests + some refactoring
fix[stable31] fix(dav): Fix share token pattern for base uri extraction
other[stable31] fix(RichObjectStrings): Make exception messages for invalid parameters more useful for debugging
breaking[stable31] test: Remove .only() calls
other[stable31] ci: Update 3rdparty actions
fix[stable31] fix(comments): Fix activity rich subject parameters
other[stable31] fix(base.php): Correct order for booting \OC\Server
other[stable31] fix(files): Make sure file pointer exists
feature[stable31] fix(auth): Allow 2FA challenges for Ephemeral sessions
other31.0.2 RC1
other31.0.2
securityFixes CVE-2025-66547: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via…
securityFixes CVE-2025-66552: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app t…
securityFixes CVE-2025-47794: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13…
other[stable31] ci(autochecks): Run some autochecks also on non-PHP files
other[stable31] fix(cron): Ignore time sensitivity when a class was explicitely scheduled
other[stable31] fix: Initialize lastConnectionCheck after first connection
other[stable31] fix(files_versions): Do not expire versions newer than min age
other[stable31] fix: wipe local storages on log out
other[stable31] fix: Change UserAgent to *cloud
other[stable31] Fix: NotFoundException for anonymous users
other[stable31] Spelling standardization
fix[stable31] fix(admin_audit): Fix incorrect truncation of files path in admin audit log
other[stable31] chore(deps-dev): bump ts-loader from 9.5.1 to 9.5.2
security[stable31] fix(security): Update CA certificate bundle
other[stable31] fix(systemtags): Use literal strings for i18n in showSuccess
other[stable31] feat: support migrating an instance to sharding
other[stable31] fix: Report duplicated extra files in integrity check
fix[stable31] fix(translation): Fix string concatenation in LDAP endpoint
fix[stable31] files: fix exception when share-attributes is undefined
other[stable31] fix(l10n): Improve english source strings
other[stable31] make it possible to run occ as root
other[stable31] fix(cypress): wait for toast to appear
other[stable31] fix(dav): Handle end of stream in File::put
otherchore(deps-dev): bump @nextcloud/eslint-config from 8.4.1 to 8.4.2
otherchore(deps): bump @nextcloud/files from 3.10.1 to 3.10.2
otherchore(deps): bump marked from 15.0.6 to 15.0.7
securityFix A+ rating when checking with Nextcloud Security Scan.
otherchore(deps): bump focus-trap from 7.6.0 to 7.6.4
otherchore(deps-dev): bump @types/dockerode from 3.3.34 to 3.3.35
other[stable31] fix(files_reminders): Do not attempt to send reminders after a user has left a share
other[stable31] Remove space
other[stable31] chore(deps): bump webdav from 5.7.1 to 5.8.0
breaking[stable31] fix: remove caching in fetchListOfGroups
other[stable31] feat: Close sessions created for login flow v2
other[stable31] fix(files_external): Move definition parameter to the correct place
other[stable31] fix(files): Ensure the filter instance is mounted
other[stable31] fix(files_trashbin): disable bulk download for trashbin
feature[stable31] refactor(TempManager): Simplify and unify implementations and remove legacy behavior
feature[stable31] feat: Add bases and gidNumber attribute to ldap:test-user-settings output
feature[stable31] feat(files): allow to ignore warning to change file type
+29 more items in the release notesother[stable31] fix: validate account properties as a repair step
other31.0.0
securityFixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…