In version 3.6.0, if a user received a malicious file share and has it synced locally or the virtual filesystem enabled and clicked a nc://open/ link it will open the default editor for the file type of the shared file, which on Windows can also sometimes mean that a file depending on the type, e.g. "vbs", is being executed. It is recommended that the Nextcloud Desktop client is upgraded to version 3.6.1. Reference: https://github.com/nextcloud/server/pull/34559 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3w86-rm38-8w63 https://github.com/nextcloud/desktop/releases/tag/v3.6.1 https://github.com/nextcloud/desktop/pull/5039
Created nextcloud-client tracking bugs for this issue: Affects: epel-8 [bug 2142766] Affects: fedora-all [bug 2142765]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.