CVE-2026-45545: Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary up to 20 bytes long SQL queries, through a stored injection. With carefully crafted input it is possible to break out of the length limitation. The attacker could use this to extract information from the database, or modify data. This issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45545?
The severity of CVE-2026-45545 is rated high with a score of 8.2.
How do I fix CVE-2026-45545?
To fix CVE-2026-45545, update Nextcloud to the latest version that is not affected by this vulnerability.
What type of vulnerability is CVE-2026-45545?
CVE-2026-45545 is an SQL Injection vulnerability that allows arbitrary SQL execution.
Who is affected by CVE-2026-45545?
Authenticated users with access to the Tables app in affected versions of Nextcloud are vulnerable to CVE-2026-45545.
What versions of Nextcloud are impacted by CVE-2026-45545?
CVE-2026-45545 affects Nextcloud versions from 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4.