# Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link

Nextcloud Desktop client's nc://open/ deeplink passes attacker-controlled file paths to QDesktopServices::openUrl, which executes uploaded .vbs files, achieving RCE on the victim.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: lukasreschke
- Disclosed: 2023-02-10
- CVE: CVE-2022-41882
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1720043
- Library page: https://bugbountylibrary.com/r/h1%3A1720043
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:medium tech:windows technique:source-review vuln:command-injection vuln:rce

**Target:** Desktop client nc://open/ deeplink handler (folderman.cpp)
**Root cause:** The local-edit feature passes the deeplink-supplied file path directly to QDesktopServices::openUrl(QUrl::fromLocalFile(...)), which executes files rather than only opening them, with no trust check on the input.
**Steps:**
1. Upload `test.vbs` containing `MsgBox "Hallo", VBOKOnly, "Ok"` to the Nextcloud web interface.
2. Craft deeplink `nc://open/<user>@<instance>/test.vbs`.
3. Victim opens the link in a browser; client resolves the path and calls `QDesktopServices::openUrl(QUrl::fromLocalFile(foundFiles.first()))`.
4. The .vbs executes on the victim host.
**How found:** Code review of PR #4771's local-edit implementation spotted QDesktopServices::openUrl being fed a deeplink-controlled path, and recognized openUrl executes files rather than merely viewing them.
**Exploitation:** Attacker uploads a malicious script to an instance the victim can access (public chats, file drop), then lures the victim to a page/link triggering the nc://open/ deeplink; the desktop client opens the local file path and the OS executes it, yielding code execution.
**Escalation:** Remote attacker reachable via any shared/public upload surface, not just self-upload; victim only needs to visit a malicious page or click a link.
**Insight:** Deeplink/custom-URL handlers that resolve to local file paths and feed QDesktopServices::openUrl (or shell open) are an execution primitive; audit any feature that maps user-supplied paths to OS open calls, and test with executable extensions like .vbs/.lnk.