How many CVEs have patched __construct?

29 published CVEs changed __construct in nextcloud/server, in 60 distinct patches totalling 399 changed lines, between 2021 and 2026.

What is the latest CVE that changed __construct?

CVE-2026-45157 (Nextcloud: Valid share tokens allow to access tempory upload files of share owner), published 2026-06-01, changed lines 29 of apps/dav/lib/Upload/RootCollection.php.

How does __construct compare to the rest of nextcloud/server?

nextcloud/server has 112 CVEs with a located fix in total; 29 of them changed __construct.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

__construct in nextcloud/server: Patched by 29 CVEs

Overview

__construct in nextcloud/server was changed by 29 published CVE fixes between 2021 and 2026, in 60 distinct patches that added or removed 399 lines in total.

The name occurs in 34 files: lib/private/Server.php, apps/dav/lib/Server.php, apps/federatedfilesharing/lib/Controller/RequestHandlerController.php, apps/dav/lib/DAV/ViewOnlyPlugin.php, apps/oauth2/lib/Controller/OauthApiController.php, core/Controller/LostController.php, lib/private/Security/RateLimiting/Limiter.php, apps/federatedfilesharing/lib/OCM/CloudFederationProviderFiles.php, apps/dav/lib/CardDAV/UserAddressBooks.php, core/Controller/AppPasswordController.php, apps/systemtags/lib/Listeners/BeforeTemplateRenderedListener.php, lib/private/Share20/DefaultShareProvider.php, core/Controller/ClientFlowLoginController.php, apps/files_external/lib/Lib/Backend/OwnCloud.php, apps/workflowengine/lib/Check/FileSystemTags.php, apps/dav/lib/Upload/RootCollection.php, apps/oauth2/lib/Settings/Admin.php, apps/oauth2/lib/Db/AccessTokenMapper.php, apps/files_sharing/lib/Controller/ExternalSharesController.php, apps/files_external/lib/Lib/Auth/Password/LoginCredentials.php, lib/private/AppFramework/DependencyInjection/DIContainer.php, apps/dav/lib/CardDAV/ContactsManager.php, lib/private/Authentication/LoginCredentials/Store.php, lib/private/PreviewManager.php, apps/files_sharing/lib/Controller/ShareInfoController.php, lib/private/AppFramework/Middleware/PublicShare/PublicShareMiddleware.php, lib/public/AppFramework/Http/DownloadResponse.php, apps/systemtags/lib/Listeners/LoadAdditionalScriptsListener.php, apps/dav/lib/CalDAV/BirthdayCalendar/EnablePlugin.php, apps/files_external/lib/Controller/GlobalStoragesController.php, lib/private/Log/ExceptionSerializer.php, lib/private/AppFramework/OCS/BaseResponse.php, apps/oauth2/lib/Controller/SettingsController.php, lib/public/User/Events/UserLoggedInEvent.php.

CVEs that patched it

Every published CVE whose fix changed __construct, newest first, with the lines each fix touched.

Nextcloud: Valid share tokens allow to access tempory upload files of share owner
CVE-2026-45157 · apps/dav/lib/Upload/RootCollection.php · line 29 · +1 −0
Medium · CVSS 6.3
EPSS 0.4%2026-06-01
Nextcloud Server users can modify tags on files that do not belong to them
CVE-2025-66547 · apps/systemtags/lib/Listeners/BeforeTemplateRenderedListener.php · lines 12–35 · +11 −0
Medium · CVSS 4.3
EPSS 0.3%2025-12-05
Nextcloud Server users can modify tags on files that do not belong to them
CVE-2025-66547 · apps/systemtags/lib/Listeners/LoadAdditionalScriptsListener.php · lines 12–35 · +11 −0
Medium · CVSS 4.3
EPSS 0.3%2025-12-05
Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list
CVE-2025-66510 · apps/dav/lib/CardDAV/ContactsManager.php · line 29 · +1 −0
Medium · CVSS 4.9
EPSS 0.4%2025-12-05
Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list
CVE-2025-66510 · apps/dav/lib/CardDAV/UserAddressBooks.php · lines 49–52 · +4 −0
Medium · CVSS 4.9
EPSS 0.4%2025-12-05
Nextcloud Server's test remote endpoint is not rate limited
CVE-2025-47791 · apps/files_sharing/lib/Controller/ExternalSharesController.php · line 24 · +0 −2
Medium · CVSS 5.3
EPSS 0.4%2025-05-16
CVE-2024-52516
CVE-2024-52516 · lib/private/Share20/DefaultShareProvider.php · line 58 · +1 −0
Medium · CVSS 4.3
EPSS 0.4%2024-11-15
Nextcloud Server is missing password confirmation when changing external storage options
CVE-2024-52518 · apps/files_external/lib/Controller/GlobalStoragesController.php · line 73 · +1 −0
Medium · CVSS 5.4
EPSS 0.5%2024-11-15
CVE-2024-52519
CVE-2024-52519 · apps/oauth2/lib/Settings/Admin.php · line 24 · +0 −1
High · CVSS 8.2
EPSS 0.5%2024-11-15
CVE-2024-52523
CVE-2024-52523 · apps/files_external/lib/Lib/Backend/OwnCloud.php · lines 28–30 · +3 −0
Medium · CVSS 6.5
EPSS 0.6%2024-11-15
Nextcloud Server User password is available in memory of the PHP process
CVE-2024-52525 · lib/private/Authentication/LoginCredentials/Store.php · lines 34–39 · +5 −2
High · CVSS 7.5
EPSS 0.3%2024-11-15
Nextcloud Server User password is available in memory of the PHP process
CVE-2024-52525 · lib/private/Server.php · lines 454–455 · +2 −1
High · CVSS 7.5
EPSS 0.3%2024-11-15
CVE-2024-37884
CVE-2024-37884 · apps/dav/lib/DAV/ViewOnlyPlugin.php · lines 39–44 · +5 −3
Medium · CVSS 5.4
EPSS 0.4%2024-06-14
CVE-2024-37884
CVE-2024-37884 · apps/dav/lib/Server.php · line 243 · +1 −1
Medium · CVSS 5.4
EPSS 0.4%2024-06-14
CVE-2024-37315
CVE-2024-37315 · apps/dav/lib/DAV/ViewOnlyPlugin.php · lines 39–44 · +5 −3
Medium · CVSS 4.3
EPSS 0.4%2024-06-14
CVE-2024-37315
CVE-2024-37315 · apps/dav/lib/Server.php · line 243 · +1 −1
Medium · CVSS 4.3
EPSS 0.4%2024-06-14
CVE-2024-22403
CVE-2024-22403 · apps/oauth2/lib/Controller/OauthApiController.php · lines 63–64 · +2 −1
Low · CVSS 3.7
EPSS 0.5%2024-01-18
CVE-2024-22403
CVE-2024-22403 · apps/oauth2/lib/Db/AccessTokenMapper.php · lines 45–48 · +4 −4
Low · CVSS 3.7
EPSS 0.5%2024-01-18
CVE-2024-22403
CVE-2024-22403 · core/Controller/ClientFlowLoginController.php · line 80 · +1 −0
Low · CVSS 3.7
EPSS 0.5%2024-01-18
CVE-2023-48304
CVE-2023-48304 · apps/dav/lib/CalDAV/BirthdayCalendar/EnablePlugin.php · lines 60–73 · +6 −1
Medium · CVSS 4.3
EPSS 0.6%2023-11-21
CVE-2023-48304
CVE-2023-48304 · apps/dav/lib/Server.php · lines 330–331 · +2 −1
Medium · CVSS 4.3
EPSS 0.6%2023-11-21
CVE-2023-45148
CVE-2023-45148 · lib/private/Server.php · lines 789–790 · +2 −2
Medium · CVSS 4.3
EPSS 0.7%2023-10-16
CVE-2023-45151
CVE-2023-45151 · apps/oauth2/lib/Controller/OauthApiController.php · lines 45–62 · +14 −31
High · CVSS 8.8
EPSS 0.5%2023-10-16
CVE-2023-45151
CVE-2023-45151 · apps/oauth2/lib/Controller/SettingsController.php · lines 44–63 · +12 −28
High · CVSS 8.8
EPSS 0.5%2023-10-16
CVE-2023-39963
CVE-2023-39963 · core/Controller/AppPasswordController.php · line 61 · +1 −0
High · CVSS 8.1
EPSS 0.3%2023-08-10
CVE-2023-28847
CVE-2023-28847 · lib/private/AppFramework/DependencyInjection/DIContainer.php · lines 307–308 · +2 −1
High · CVSS 7.5
EPSS 0.8%2023-04-25
CVE-2023-28847
CVE-2023-28847 · lib/private/AppFramework/Middleware/PublicShare/PublicShareMiddleware.php · lines 48–67 · +10 −1
High · CVSS 7.5
EPSS 0.8%2023-04-25
CVE-2023-30539
CVE-2023-30539 · apps/workflowengine/lib/Check/FileSystemTags.php · lines 61–77 · +14 −7
High · CVSS 8.8
EPSS 0.6%2023-04-17
CVE-2023-25161
CVE-2023-25161 · core/Controller/LostController.php · lines 106–123 · +3 −1 in 2 hunks
Medium · CVSS 5.3
EPSS 0.7%2023-02-13
CVE-2023-25161
CVE-2023-25161 · lib/private/Security/RateLimiting/Limiter.php · line 48 · +1 −1
Medium · CVSS 5.3
EPSS 0.7%2023-02-13
CVE-2023-25159
CVE-2023-25159 · lib/private/PreviewManager.php · lines 78–93 · +11 −9
Medium · CVSS 5.3
EPSS 0.5%2023-02-13
CVE-2023-25159
CVE-2023-25159 · lib/private/Server.php · line 338 · +1 −0
Medium · CVSS 5.3
EPSS 0.5%2023-02-13
CVE-2022-31120
CVE-2022-31120 · apps/federatedfilesharing/lib/Controller/RequestHandlerController.php · lines 102–117 · +3 −1 in 2 hunks
Low · CVSS 2.7
EPSS 0.9%2022-08-04
Rate-limits not working on instances without configured memory cache backend
CVE-2021-41177 · lib/private/Security/RateLimiting/Limiter.php · lines 32–43 · +1 −7
High · CVSS 8.1
EPSS 1.6%2021-10-25
Rate-limits not working on instances without configured memory cache backend
CVE-2021-41177 · lib/private/Server.php · lines 790–803 · +14 −4
High · CVSS 8.1
EPSS 1.6%2021-10-25
CVE-2021-32801
CVE-2021-32801 · lib/private/Log/ExceptionSerializer.php · lines 127–176 · +50 −1
Medium · CVSS 5.5
EPSS 0.2%2021-09-07
CVE-2021-32725
CVE-2021-32725 · apps/federatedfilesharing/lib/OCM/CloudFederationProviderFiles.php · lines 143–160 · +3 −1 in 2 hunks
Medium · CVSS 5.3
EPSS 1.2%2021-07-12
CVE-2021-32703
CVE-2021-32703 · apps/files_sharing/lib/Controller/ShareInfoController.php · line 51 · +1 −1
Medium · CVSS 5.3
EPSS 1.5%2021-07-12
CVE-2021-32679
CVE-2021-32679 · lib/public/AppFramework/Http/DownloadResponse.php · lines 33–42 · +2 −6
High · CVSS 8.8
EPSS 1.4%2021-07-12
CVE-2021-32678
CVE-2021-32678 · lib/private/AppFramework/OCS/BaseResponse.php · lines 78–82 · +5 −0
Medium · CVSS 5.3
EPSS 1.4%2021-07-12
CVE-2020-8296
CVE-2020-8296 · apps/files_external/lib/Lib/Auth/Password/LoginCredentials.php · lines 53–98 · +29 −22
Medium · CVSS 6.7
EPSS 0.5%2021-03-03
CVE-2021-22877
CVE-2021-22877 · lib/private/Server.php · line 578 · +1 −1
Medium · CVSS 6.5
EPSS 1.7%2021-03-03
CVE-2021-22877
CVE-2021-22877 · lib/public/User/Events/UserLoggedInEvent.php · lines 46–57 · +5 −1
Medium · CVSS 6.5
EPSS 1.7%2021-03-03

Get an alert when the next CVE fix lands in nextcloud/server, with the patched functions.

Monitor server CVEs

__construct

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track nextcloud/server CVEs