PHP Vulnerability Responses by Company

Nextcloud GmbH

Global cloud / infrastructure
Aliases / services
ネクストクラウド / Nextcloud Hub / Nextcloud AIO / Nextcloud / Nextcloud GmbH
Official website
https://nextcloud.com/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Nextcloud All-in-One (AIO)

Response status
Fixed release available; update required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provides file sharing and collaboration servers.

AIO v14.4.1 includes updated PHP dependencies and is recommended by the maintainer.

Scope: Separate from standalone deployments and other Docker images; availability is not deployment.

What users should do

Apply the official AIO update and verify running containers were updated.

Official service URL

Source URLs

  1. Nextcloud AIO: PHP CVEs. Update required!https://github.com/nextcloud/all-in-one/issues/8876Response evidence
  2. https://github.com/nextcloud/all-in-one/releases/tag/v14.4.1https://github.com/nextcloud/all-in-one/releases/tag/v14.4.1Service and operation documentation

Nextcloud (community Docker image)

Response status
Follow-up mitigation integrated; update required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The October23 follow-up mitigation disabling upload progress was merged into the official image repository.

Scope: Different from AIO; follow-up mitigation does not replace PHP2Shell patches.

What users should do

Refresh/recreate the image and verify patched PHP and the added setting.

Source URLs

  1. https://github.com/nextcloud/docker/pull/2614https://github.com/nextcloud/docker/pull/2614Response evidence
  2. https://github.com/docker-library/official-images/pull/22578https://github.com/docker-library/official-images/pull/22578Service and operation documentation
Related official sources
  1. Nextcloud PHP vulnerability noticeOfficial noticeThe previously unavailable reference is now readable. The conclusion remains limited to the scope of the official incident/update notice.
  2. Nextcloud AIO: PHP CVEs. Update required!Official notice

Comments