CVE-2026-45545: Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution

Synopsis

SQL injection in the Nextcloud Tables app affects versions 0.7.0 through several release branches up to 1.0.x. The vulnerability is reachable over the network by an authenticated attacker with a low-privilege account, with no victim interaction required, though exploitation involves high attack complexity. Successful exploitation lets an attacker execute arbitrary SQL queries against the underlying database, enabling data extraction or modification. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream fix versions are confirmed in distributed packages.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Tables app endpoint is exposed over the network, so an attacker must be able to reach the Nextcloud instance remotely to deliver the injection payload.

• AuthenticationRequired

  A low-privilege account with access to the Nextcloud Tables app is sufficient; no administrative rights are needed.

• Victim interactionNot required

  The injection is stored and triggered server-side, so no user needs to click a link or take any action for the payload to execute.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must carefully craft input to bypass a 20-byte SQL fragment length limit, likely requiring multiple attempts or chained techniques to break out of the restriction.

Blast Radius

• An attacker reads arbitrary rows from the Nextcloud database, including stored file metadata, user records, and session-related data.
• An attacker modifies persisted database rows, altering file references, user settings, or application state.
• The scope of impact extends beyond the Tables app itself because the injected queries run in the database context shared by other Nextcloud components (CVSS scope change: Changed).