# Nextcloud vulnerabilities

**URL:** https://discuss.privacyguides.net/t/nextcloud-vulnerabilities/24730
**Category:** General
**Created:** 2025-02-06T23:27:12Z
**Posts:** 8

## Post 1 by @ph00lt0 — 2025-02-06T23:27:12Z

Well yeah suprise suprise here are some big flaws in nextcloud again. This time found by BSI (german infosec authority)

For none german readers the gist is: update to patch. What was vulnerable is the 2FA, External Storage Support, and File Share via Federation with some plain text passwords.

> **[BSI untersucht Open Source Software "Nextcloud"](https://www.bsi.bund.de/DE/Service-Navi/Presse/Alle-Meldungen-News/Meldungen/Projekt-CAOS-30_Nextcloud_250205.html)**
>
> Im Rahmen eines Projektes zur Codeanalyse von Open Source Software (CAOS) hat das BSI die Open Source Kollaborationssoftware "Nextcloud" auf ihre Sicherheitseigenschaften untersucht.

---

## Post 2 by @ph00lt0 — 2025-02-06T23:28:59Z

Found english article:

[https://www.heise.de/en/news/BSI-analysis-shows-Nextcloud-server-stored-passwords-in-plain-text-10273259.html](https://www.heise.de/en/news/BSI-analysis-shows-Nextcloud-server-stored-passwords-in-plain-text-10273259.html)

---

## Post 3 by @anon36940904 — 2025-02-06T23:31:08Z

Does this mean OwnCloud is a better option?

---

## Post 4 by @ph00lt0 — 2025-02-06T23:33:01Z

Afaik neither have properly implemented and good working e2ee.

These flaws have now been addressed. But yeah the way both are built (nc is a fork of occ) i would not rely on publically accessible instances. If you take other measures and know how too it may have a use case else just use a provider that actually uses e2ee so problems like these are less troublesome.

---

## Post 5 by @anon36940904 — 2025-02-06T23:36:05Z

That’s unfortunate. Can’t we have one good option for all of what Nextcloud provides as a workspace and storage solution.

---

## Post 6 by @ph00lt0 — 2025-02-06T23:37:08Z

Why cant we have nice things?

---

## Post 7 by @anon36940904 — 2025-02-06T23:38:06Z

That was a rhetorical statement written as a question. I didn’t literally mean it.

---

## Post 8 by @sha123 — 2025-02-07T12:26:16Z

Owncloud Infinite Scale might be a more secure option due to its heavy use of memory safe language (mainly written in Go) and modern design. Unfortunately it does not have end-to-end encryption either and it’s not as battle tested and feature rich as Nextcloud.