# File-drop content is visible through the gallery app

Nextcloud Gallery app exposed upload-only file-drop contents via /apps/gallery/s/<token>, letting anyone view and download media despite hide-download.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: nursoda
- Disclosed: 2020-01-31
- CVE: CVE-2020-8119
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/719426
- Library page: https://bugbountylibrary.com/r/h1%3A719426
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:php vuln:access-control vuln:business-logic vuln:info-disclosure

**Target:** Nextcloud Gallery app share endpoint (/apps/gallery/s/<token>)
**Root cause:** Gallery app resolves share tokens without honoring the upload-only (file-drop) permission, rendering folder contents.
**Steps:**
1. Create folder, share as upload-only file-drop, note token `randompath`.
2. Confirm `https://cloud.domain.com/s/randompath` shows only upload UI.
3. Upload media files.
4. Visit `https://cloud.domain.com/apps/gallery/s/randompath` to view and download all uploaded media, even with hide-download set.
**How found:** Researcher reasoned the Gallery app consumes the same share token and tried the gallery-prefixed URL against a file-drop share.
**Exploitation:** Anyone with the share link swaps the /s/ path for /apps/gallery/s/ to enumerate and download all uploaded media, defeating upload-only and hide-download.
**Insight:** When a share token is honored by multiple apps, test each app's route (/apps/gallery/s/, etc.) against restrictive share modes like upload-only or hide-download.