CVE-2019-12739

Severity CVSS v4.0:
Pending analysis
Type:
CWE-78 OS Command Injections
Publication date:
05/06/2019
Last modified:
06/06/2019

Description

lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters).

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:nextcloud:extract:*:*:*:*:*:nextcloud:*:* 1.2.0 (excluding)