# Stored XSS on Share-popup of a directory's Gallery-view

Stored XSS in Nextcloud Gallery-view share popup via unsanitized folder name, exploitable in browsers lacking CSP support.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: fransrosen
- Disclosed: 2016-07-19
- CVE: CVE-2016-7419
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/145355
- Library page: https://bugbountylibrary.com/r/h1%3A145355
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:php technique:regression vuln:xss

**Target:** Gallery-view share popup in Nextcloud Files
**Root cause:** Gallery app migration to new sharing endpoint changed a parameter from integer to string; the value was not sanitized, allowing HTML injection.
**Steps:**
1. Create a folder with a malicious name like `<img src=x onerror=alert(1)>`.
2. Share the folder with a victim.
3. Have the victim open the shared folder in the Gallery app.
4. Victim clicks the Share-icon in Gallery-view, triggering the payload.
**How found:** Researcher noticed a Share-icon appeared in Gallery-view of a directory and tested a malicious folder name, observing HTML execution.
**Exploitation:** Authenticated attacker shares a folder with a crafted HTML name; victim opens it in Gallery-view and clicks Share-icon, executing script in their browser (only in browsers without CSP support).
**Escalation:** Could target admins since any user can create files, but limited to non-CSP browsers.
**Insight:** When apps migrate endpoints, parameter type changes (int to string) can reintroduce injection; test legacy UI surfaces like Gallery-view share popups with crafted names.