Problem: Nextcloud Security Fix for CVE-2026-109618 & CVE-2026-109619 Vulnerability on UCS 5.2

Knowledge Base Community
, , , , ,
1

Problem

Nextcloud environments are vulnerable to security risks associated with CVE-2026-109618 & CVE-2026-109619. Issues are detailed in GitHub #1693. This vulnerability stems from an underlying PHP issue that can affect server behavior and security when running impacted Nextcloud container/server images.

Root Cause

The issue is caused by a missing PHP fix in older Nextcloud application releases packaged for Univention Corporate Server (UCS) 5.2.

The following Nextcloud versions under UCS 5.2 are affected by this issue:

  • 30.0.15-0
  • 31.0.9-0
  • 32.0.3-0
  • 32.0.6-0
  • 32.0.12-0
  • 32.0.13-0

Solution

An update for Nextcloud implementing the necessary PHP fix is now available in the Univention App Center.

The fixed version 33.0.10-0 (5.2/nextcloud=33.0.10-0) has been officially released for UCS 5.2.

Verification and Upgrade Steps

  1. Update the appcenter repository and verify available App Versions:
    Run the following command to check the list of available versions for Nextcloud:

    univention-app update
univention-app list nextcloud

    Output:

    nextcloud
   Name: Nextcloud Hub
   Versions:
     33.0.10-0
     30.0.15-0
     31.0.9-0
     32.0.3-0
     32.0.6-0
     32.0.12-0
     32.0.13-0

  2. Upgrade Nextcloud:
    Upgrade to the latest Nextcloud application by executing:

    univention-app upgrade nextcloud

References

1 Like