{"id":"CVE-2021-32733","details":"Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, use a browser that has support for Content-Security-Policy.","aliases":["GHSA-x4w3-jhcr-57pq"],"modified":"2026-10-22T02:48:01.992401287Z","published":"2021-07-12T21:15:07.913Z","database_specific":{},"references":[{"type":"ADVISORY","url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x4w3-jhcr-57pq"},{"type":"REPORT","url":"https://hackerone.com/reports/1241460"},{"type":"FIX","url":"https://github.com/nextcloud/text/pull/1689"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nextcloud/text","events":[{"introduced":"0"},{"fixed":"794f7f4bfc64d43ca8f04ef0a1eac5a1b3d539e9"},{"introduced":"250a34891e0dbdb70dde636e665d54d66e2491ef"},{"fixed":"5dd3b8bffef3c74a4993a307acc2ffacf0db5dc6"},{"introduced":"e032cea1e2787a3454d3a759bddf8fbff4f56c4e"},{"fixed":"ce2015d3ef065859f6c2fac983ce8ec846b84b0e"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"19.0.13"}]},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*","range":[{"introduced":"20.0.0"},{"fixed":"20.0.11"}]},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*","range":[{"introduced":"21.0.0"},{"fixed":"21.0.3"}]}]}}],"versions":["v19.0.13rc1","v20.0.11rc1","v21.0.3rc1","v19.0.12","v19.0.11","v21.0.2","v20.0.10","v19.0.11RC1","v20.0.10RC1","v21.0.2RC1","v19.0.10","v20.0.9","v21.0.1","v19.0.10RC1","v20.0.9RC1","v21.0.1RC1","v20.0.8","v19.0.9","v21.0.0","v19.0.9RC1","v20.0.8RC1","v20.0.7","v20.0.7RC1","v19.0.8","v20.0.6","v19.0.8RC1","v20.0.6RC1","v19.0.7","v20.0.5RC2","v20.0.5","v19.0.7RC1","v20.0.5RC1","v20.0.4","v19.0.6","v20.0.3","v19.0.6RC2","v20.0.3RC2","v19.0.5","v20.0.2","v19.0.5RC2","v20.0.2RC2","v20.0.2RC1","v19.0.5RC1","v20.0.1RC1","v20.0.1","v20.0.0","v19.0.4","v19.0.4RC2","v19.0.40RC1","v19.0.3","v19.0.3RC1","v19.0.2","v19.0.2RC2","v19.0.2RC1","v19.0.1","v19.0.1RC1","v19.0.0RC3","v19.0.0","v19.0.0RC1","v19.0.0beta7","v19.0.0beta6","v19.0.0beta5","v19.0.0beta4","v19.0.0beta3","v19.0.0beta2","v19.0.0beta1","v1.0.2","v1.0.1","v1.0.0","v1.0.0-alpha2","v1.0.0-alpha1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-32733.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}