{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "25.0.0"
              },
              {
                "fixed": "25.0.9"
              },
              {
                "introduced": "25.0.0"
              },
              {
                "fixed": "25.0.9"
              },
              {
                "introduced": "26.0.0"
              },
              {
                "fixed": "26.0.4"
              },
              {
                "introduced": "26.0.0"
              },
              {
                "fixed": "26.0.4"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "27.0.0"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "27.0.0"
              }
            ]
          },
          "events": [
            {
              "introduced": "20ea9a25353129b56d46951fe7d23939665ab2b2"
            },
            {
              "fixed": "fbc4a4aad97572da902fef0ee61cbd49bba58365"
            },
            {
              "introduced": "20ea9a25353129b56d46951fe7d23939665ab2b2"
            },
            {
              "fixed": "fbc4a4aad97572da902fef0ee61cbd49bba58365"
            },
            {
              "introduced": "62cfd3b4c9ff4d8cdbbe6dcc8b63a1085bb94e3d"
            },
            {
              "fixed": "318ac2714fafa63dcd90805a5cb8ee9d60b58f53"
            },
            {
              "introduced": "62cfd3b4c9ff4d8cdbbe6dcc8b63a1085bb94e3d"
            },
            {
              "fixed": "318ac2714fafa63dcd90805a5cb8ee9d60b58f53"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "add4e4365a4040d2e4e6aa79c0d03c3edd78583c"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "add4e4365a4040d2e4e6aa79c0d03c3edd78583c"
            }
          ],
          "repo": "https://github.com/nextcloud/server",
          "type": "GIT"
        }
      ]
    },
    {
      "ranges": [
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "25.0.0"
              },
              {
                "fixed": "25.0.9"
              }
            ]
          },
          "events": [
            {
              "introduced": "b610140d60b978131bb4c4bf24c383946b9f8bae"
            },
            {
              "fixed": "3930f6b81e8f6285710dce808e2338b0fb504f4f"
            }
          ],
          "repo": "https://github.com/nextcloud/text",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "27.0.0"
              },
              {
                "fixed": "27.0.1"
              }
            ]
          },
          "events": [
            {
              "introduced": "3fce0e2feb1e6528a77a441610063051b77cfdde"
            },
            {
              "fixed": "94b8cc5a1612568d231c710339c211e5022afd67"
            }
          ],
          "repo": "https://github.com/nextcloud/text",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "26.0.0"
              },
              {
                "fixed": "26.0.4"
              }
            ]
          },
          "events": [
            {
              "introduced": "18cce808c81d44dbfec09832c994ebcf28d37757"
            },
            {
              "fixed": "fded8a652bb9dd9015f0819992ee5ff216a3d3fb"
            }
          ],
          "repo": "https://github.com/nextcloud/text",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-qhgm-w4gx-gvgp"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39961.json"
  },
  "details": "Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and download it. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.",
  "id": "CVE-2023-39961",
  "modified": "2026-04-01T23:08:01.226079605Z",
  "published": "2023-08-10T17:18:40.903Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1965156"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39961.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qhgm-w4gx-gvgp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39961"
    },
    {
      "type": "FIX",
      "url": "https://github.com/nextcloud/text/pull/4481"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Text does not respect \"Allow download\" permissions"
}