Medium
Security advisory
Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-5450
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:35 UTC · Revision 1
Source evidence
Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML.
osv:CVE-2019-5450
Complete source record
{
"id": "730e80f1a02ae3efd741b34aee124fe98b754d63c9115ff7b97eabe6c45e029f",
"url": "https://osv.dev/vulnerability/CVE-2019-5450",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-5450",
"summary": "Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML.",
"evidence": "osv:CVE-2019-5450",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-5450",
"aliases": [
"CVE-2019-5450"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nextcloud/android",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "669073b27862a27ca58a8551be64ffaa44522363"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.7.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"rc-3.7.0-04",
"rc-3.7.0-03",
"rc-3.7.0-02",
"rc-3.7.0-01",
"dev-20190605",
"dev-20190604",
"dev-20190601",
"dev-20190531",
"dev-20190530",
"dev-20190529",
"dev-20190528",
"dev-20190524",
"dev-20190523",
"dev-20190522",
"dev-20190521",
"dev-20190520",
"dev-20190518",
"dev-20190517",
"dev-20190515",
"dev-20190514",
"dev-20190513",
"dev-20190502",
"dev-20190414",
"dev-20190413",
"dev-20190412",
"dev-20190411",
"dev-20190410",
"dev-20190409",
"dev-20190408",
"dev-20190406",
"dev-20190404",
"dev-20190403",
"dev-20190402",
"dev-20190329",
"dev-20190328",
"rc-3.6.0-01",
"dev-20190327",
"dev-20190323",
"dev-20190321",
"dev-20190320",
"dev-20190319",
"dev-20190316",
"dev-20190314",
"dev-20190313",
"dev-20190312",
"dev-20190310",
"dev-20190309",
"dev-20190308",
"dev-20190307",
"dev-20190306",
"dev-20190305",
"dev-20190301",
"dev-20190228",
"dev-20190227",
"dev-20190226",
"dev-20190221",
"dev-20190220",
"dev-20190219",
"dev-20190216",
"dev-20190215",
"dev-20190214",
"dev-20190213",
"dev-20190212",
"dev-20190209",
"dev-20190208",
"dev-20190207",
"dev-20190206",
"dev-20190205",
"dev-20190202",
"dev-20190201",
"dev-20190131",
"dev-20190130",
"dev-20190129",
"dev-20190126",
"dev-20190123",
"dev-20190122",
"dev-20190119",
"dev-20190118",
"dev-20190117",
"dev-20190116",
"dev-20190115",
"dev-20190113",
"dev-20190112",
"dev-20190108",
"dev-20190105",
"dev-20181222",
"dev-20181218",
"dev-20181216",
"dev-20181215",
"dev-20181214",
"dev-20181212",
"dev-20181211",
"dev-20181208",
"dev-20181207",
"dev-20181206",
"dev-20181204",
"dev-20181203",
"dev-20181107",
"dev-20181106",
"dev-20181103",
"dev-20181102",
"dev-20181101",
"dev-20181031",
"dev-20181030",
"dev-20181028",
"dev-20181027",
"dev-20181026",
"dev-20181025",
"dev-20181024",
"dev-20181023",
"dev-20181020",
"dev-20181018",
"dev-20181016",
"dev-20181013",
"dev-20181009",
"dev-20181006",
"dev-20180927",
"dev-20180926",
"dev-20180925",
"dev-20180924",
"dev-20180921",
"dev-20180920",
"dev-20180919",
"dev-20180918",
"dev-20180915",
"dev-20180914",
"dev-20180907",
"dev-20180913",
"dev-20180912",
"dev-20180911",
"dev-20180908",
"dev-20180905",
"dev-20180903",
"dev-20180829",
"dev-20180825",
"dev-20180824",
"dev-20180823",
"dev-20180821",
"dev-20180811",
"dev-20180809",
"rc-3.1.0-02",
"rc-3.1.0-01",
"rc-3.0.0-03",
"rc-3.0.0-02",
"rc-3.0.0-01",
"dev-20171213",
"dev-20171212",
"dev-20171211",
"dev-20171209",
"stable-2.0.0",
"rc-2.0.0-09",
"rc-2.0.0-08",
"rc-2.0.0-07",
"rc-2.0.0-06",
"rc-2.0.0-05",
"rc-2.0.0-04",
"rc-2.0.0-03",
"rc-2.0.0-01",
"stable-1.4.3",
"stable-1.4.2",
"rc-1.4.2-04",
"rc-1.4.2-02",
"rc-1.4.2-01",
"stable-1.4.1",
"rc-1.4.1-04",
"rc-1.4.1-03",
"rc-1.4.1-02",
"rc-1.4.1-01",
"stable-1.4.0",
"rc-1.4.0-04",
"rc-1.4.0-03",
"rc-1.4.0-02",
"rc-1.4.0-01",
"stable-1.3.1",
"stable-1.3.0",
"rc-1.3.0-02",
"rc-1.3.0-01",
"stable-1.2.0",
"rc-1.2.0-02",
"rc-1.2.0-01",
"stable-1.1.0",
"rc-1.1.0-02",
"rc-1.1.0-01",
"stable-1.0.1",
"stable-1.0.0",
"1.0.0",
"0.99",
"oc-android-1.8",
"oc-android-1.7.1_signed",
"oc-android-1.7.0_signed",
"oc-android-1.7.0",
"oc-android-1.5.3",
"1.4.6-easy-setup",
"oc-android-1.4.6",
"oc-android-1.4.5",
"oc-android-1.4.4",
"oc-android-1.4.3",
"oc-android-1-4-0",
"oc-android-1-3-20",
"oc-android-1-3-19",
"oc-android-1-3-18",
"oc-android-1-3-17",
"oc-android-1-3-14",
"oc-android-1-3-13"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-5450.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/nextcloud/desktop",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "292d6973a33c08950bc3955d9d2b20ffafc58957"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.7.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.7.0-rc1",
"v3.6.0",
"v3.6.0-rc2",
"v3.6.0-rc1",
"v3.5.0",
"v3.5.0-rc4",
"v3.5.0-rc3",
"v3.5.0-rc2",
"v3.5.0-rc1",
"v3.4.0-do-not-use",
"v3.4.0-rc2",
"v3.4.0-rc1",
"v3.3.0",
"v3.3.0-rc2",
"v3.3.0-rc1",
"v3.2.0-rc3",
"v3.2.0-rc2",
"v3.2.0-rc1",
"v3.1.0",
"v3.1.0-rc2",
"v3.1.0-rc1",
"v2.7.0-rc1",
"v2.7.0-beta3",
"v2.7.0-beta2",
"v2.7.0-beta1",
"v2.5.3-rc2",
"v2.5.3-rc1",
"v2.5.2",
"v2.5.2-rc1",
"v2.5.1",
"v2.5.0",
"v2.5.0-rc2",
"v2.5.0-rc1",
"v2.5.0-beta2",
"v2.5.0-beta1",
"v1.8.0-beta1a",
"v1.8.0-beta1",
"v1.6.0",
"v1.6.0-rc3",
"v1.6.0-rc2",
"v1.6.0-rc1",
"v1.6.0-beta2",
"v1.6.0-beta1",
"v1.5.1-rc1",
"v1.5.0",
"v1.5.0-beta3",
"v1.5.0-beta1-2nd",
"v1.5.0-beta2",
"v1.5.0-beta1",
"v1.4.0",
"v1.4.0-rc1",
"v1.4.0-beta2",
"v1.4.0-beta1",
"v1.3.0-beta3",
"v1.3.0-beta2",
"v1.3.0-beta1",
"v1.2.5",
"v1.2.4",
"v1.2.3",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.2",
"v1.1.0",
"v1.1.0-beta1",
"v0.0.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-5450.json"
}
}
],
"modified": "2026-10-24T10:30:20.456917840Z",
"provider": "osv",
"references": [
"https://hackerone.com/reports/631227"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*"
],
"vendor_product": "nextcloud:nextcloud",
"extracted_events": [
{
"range": [
{
"fixed": "3.7.0"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-5450",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 430279,
"published_at": "2019-07-30T21:15:11.647+00:00"
}