The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of end-to-end encrypted files. Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4303 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4303-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     September 18, 2025                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : nextcloud-desktop     Version        : 3.1.1-2+deb11u2     CVE ID         : CVE-2022-39331 CVE-2022-39332 CVE-2022-39333 CVE-2022-39334                      CVE-2023-28997

    Multiple vulnerabilities were discovered in nextcloud-desktop,     nextcloud folder synchronization tool.

    CVE-2022-39331

        An attacker can inject arbitrary HyperText Markup Language into         the Desktop Client application in the notifications.

    CVE-2022-39332

        An attacker can inject arbitrary HyperText Markup Language into         the Desktop Client application via user status and information.

    CVE-2022-39333

        An attacker can inject arbitrary HyperText Markup Language into         the Desktop Client application.

    CVE-2022-39334

        A CLI utility called nextcloudcmd which is sometimes used for         automated scripting and headless servers would incorrectly trust         invalid TLS certificates, which may enable a Man-in-the-middle         attack that exposes sensitive data or credentials to a network         attacker.

    CVE-2023-28997

        A malicious server administrator can recover and modify the         contents of end-to-end encrypted files.

    For Debian 11 bullseye, these problems have been fixed in version     3.1.1-2+deb11u2.

    For Debian 11 bullseye, these problems have been fixed in version     3.1.1-2+deb11u2.

    We recommend that you upgrade your nextcloud-desktop packages.

    For the detailed security status of nextcloud-desktop please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nextcloud-desktop

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version     3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of     end-to-end encrypted files. Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch.
    No known workarounds are available. (CVE-2023-28997)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer.
    Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such
    as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for
    javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are
    no known workarounds for this issue. (CVE-2023-23942)

  - The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version
    3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of
    end-to-end encrypted files. Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch.
    No known workarounds are available. (CVE-2023-28997)

  - The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version
    3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end
    encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should
    upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.
    (CVE-2023-28998)

ID	Name	Product	Family	Severity
265376	Debian dla-4303 : caja-nextcloud - security update	Nessus	Debian Local Security Checks	medium
227029	Linux Distros Unpatched Vulnerability : CVE-2023-28997	Nessus	Misc.	medium
405729	Alpine: multiple nextcloud-client packages: security update to 3.6.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
405729	Alpine: multiple nextcloud-client packages: security update to 3.6.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium

Detections

Analytics

CVE-2023-28997

medium

Tenable Plugins

medium

medium

medium

medium