CVE-2024-46958

What it actually does

On Linux, the Nextcloud Desktop Client sets incorrect file permissions during synchronization, resulting in synced files being created with world-readable or world-writable modes.

Why it matters to the business

Local users on affected Linux systems can read or modify files that should remain private, increasing risk of data exposure or tampering with no external network access required.

How an attack unfolds

An attacker with local shell access on a Linux workstation inspects permissions on files synchronized by the vulnerable client and directly reads or alters content that was intended to be restricted to the owner.

How to fix it

Upgrade Nextcloud Desktop Client to version 3.13.4 or newer; after upgrade, re-sync folders and verify that file permissions are restricted to owner-only access.

How to confirm the fix worked

Confirm client version is 3.13.4 or later, then create a new synchronized file and inspect its permissions with stat or ls -l to ensure no world-readable or world-writable bits are present.

Typical attack path

1. Obtain local user or root access on the Linux endpoint running the client
2. Locate Nextcloud synchronized directories
3. Observe world-readable or world-writable permission bits on files
4. Read sensitive content or write modifications to the files

How to detect it

Review synchronized folder permissions with stat or ls -l on Linux endpoints; look for files carrying 0777, 0775, 0666 or similar world-accessible modes created during the vulnerable client window.

What your security team should do

• Immediately upgrade all Linux installations of the desktop client to 3.13.4
• Audit permissions on existing synchronized directories across endpoints
• Add client version checks to endpoint compliance scans
• Monitor for future permission-related sync issues in release notes