Summary
- Crafted files can trigger a vulnerable ImageMagick component through certain optional Nextcloud preview providers.
- Exploitation requires an account or writable share link, and the affected preview providers are disabled by default.
- Corrected community releases include Nextcloud Server 32.0.13, 33.0.7, and 34.0.2.
Nextcloud has patched a high-severity server vulnerability that can allow crafted files to reach a vulnerable ImageMagick component through its preview function, creating a path to arbitrary file writes and further server compromise.
The advisory, published on 17 September, concerns deployments using vulnerable versions of Imagick together with particular optional preview providers.
An attacker needs access to a Nextcloud account or a writable share link. They can then upload a corrupted file and request a preview, causing the server to process attacker-controlled content through the affected image-processing component.
Nextcloud says the underlying ImageMagick flaw can allow arbitrary files to be written to the system. Those files could then be used for subsequent attacks against the server, including code execution.
The vulnerability carries a CVSS score of 7.4. Its exposure is narrower than an unauthenticated internet-facing remote-code-execution flaw because an attacker requires an initial ability to upload content and trigger preview processing.
Configuration further limits the attack surface. The affected HEIC, Illustrator, PDF, Photoshop, Postscript, SGI, TGA, and TIFF preview providers are not enabled by default.
Community editions 32.0.13, 33.0.7, and 34.0.2 contain the fix, alongside corrected Enterprise Server releases across a wider range of supported branches. Nextcloud also provides several mitigations, including removing Imagick from PHP, disabling previews, or removing the affected providers from the permitted preview configuration.
The vulnerability sits at a recurring boundary in file-sharing and collaboration systems. Applications designed to accept complex external content regularly invoke image libraries, document converters, archive handlers, thumbnail generators, and other third-party parsers to make uploaded files usable.
A preview may appear to be a passive convenience feature from the user’s perspective, but on the server it can involve active parsing and conversion of content supplied by another party. Security therefore depends not only on the application’s own code but also on the patch state and behaviour of the components it calls.
That distinction is relevant to self-hosted cloud environments. One of the attractions of platforms such as Nextcloud is greater control over data location, administration, and infrastructure dependency. The same model places responsibility for application versions, dependencies, PHP modules, operating-system packages, and configuration with the operator or its hosting provider.
The requirement for an account or writable link does not eliminate enterprise exposure. External collaboration, contractor accounts, shared folders, and user-generated content routinely create situations in which less-trusted parties are permitted to upload files without receiving broader administrative access.
Optional features also complicate vulnerability management. An inventory showing that an organisation runs a vulnerable Nextcloud branch does not by itself establish exploitability; administrators need to know whether Imagick is present and which preview providers have been enabled.
Conversely, organisations that rely only on default-configuration assumptions can miss historical changes made to support business workflows. A preview provider enabled years earlier to support design, PDF, or imaging files may still be active long after the original requirement has been forgotten.
The advisory has no CVE identifier at the time of publication, making product version and configuration checks more useful than CVE-only asset searches. Nextcloud credits Yordan Ganchev of watchTowr with reporting the issue.
