Back Linuxsecurity

Fedora 42 nextcloud 33.0.3 Important Remote Code Exec Vuln 2026

Linuxsecurity •LinuxSecurity Advisories • May 10, 2026

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing right on the web. NextCloud is extendable via a simple but powerful API for applications and plugins. Update Information : 33.0.3 Release

NextCloud gives you universal access to your files through a web interface or

WebDAV. It also provides a platform to easily view & sync your contacts,

calendars and bookmarks across all your devices and enables basic editing right

on the web. NextCloud is extendable via a simple but powerful API for

applications and plugins.

* Sat May 2 2026 Andrew Bauer - 33.0.3-1 - 33.0.3 Release RHBZ#2454311 * Sat Apr 18 2026 Andrew Bauer - 33.0.1-2 - fix cli upgrade advice

[ 1 ] Bug #2452582 - CVE-2026-33916 nextcloud: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [fedora-all] [ 2 ] Bug #2452588 - CVE-2026-33937 nextcloud: Handlebars: Remote Code Execution via crafted Abstract Syntax Tree object in compile() [epel-all] [ 3 ] Bug #2452590 - CVE-2026-33938 nextcloud: Handlebars: Arbitrary code execution via @partial-block overwrite [epel-all] [ 4 ] Bug #2452593 - CVE-2026-33939 nextcloud: Handlebars.js: Denial of Service via malformed decorator syntax in template compilation [epel-all] [ 5 ] Bug #2452596 - CVE-2026-33940 nextcloud: Handlebars.js: Arbitrary code execution via crafted template context [epel-all] Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-2fed8dd674' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE and DoS Vulnerabilities in Nextcloud Affect Fedora Users On May 2, 2026, Fedora released an advisory for Nextcloud version 33.0.3, addressing multiple critical vulnerabilities, including remote code execution (RCE) and denial of service (DoS) issues. The vulnerabilities are linked to the Handlebars.js templating engine, with CVEs including CVE-2026-33937, CVE-2026-33939, CVE-2026-33940, CVE-2026-33916, and CVE-2026-33938, all published on March 27, 2026. Attack vectors involve crafted Abstract Syntax Tree objects and malformed decorator syntax, allowing for arbitrary code execution and service disruption. Users of Fedora 42 and 44 are specifically affected, and administrators are urged to apply the patches using the 'dnf' update program. The vulnerabilities pose a significant risk due to their potential for exploitation in live environments. As of now, no active exploitation has been reported, but the existence of proof-of-concept (PoC) exploits raises concerns. 3 sources 71

Extracted Entities

Fedora 42 nextcloud 33.0.3 Important Remote Code Exec Vuln 2026

The full story

Extracted Entities

Attack Types (1)

CVEs (5)

CWE Weaknesses (2)

Vulnerabilities (1)