Confidentiality Bypass via Filename # in DOCX/ODT Upload
CVE-2026-77173 Published on October 27, 2026
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-77173 has been classified to as an Authorization vulnerability or weakness.
Affected Versions
Nextcloud Files Confidential:- Version 3.3.0, <= 5.0.0 is affected.