CVE-2019-12739
lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters).
CVSS 3.0 · 9 Critical
EPSS 2.5%
KEV · Not listed
Vendors
Products