CVE-2026-77173 in Nextcloud
Summary
by MITRE • 10/27/2026
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability described involves a flaw in how document processing applications handle metadata classification based on filenames containing specific special characters, particularly the hash symbol. When users create documents such as Microsoft Word docx or OpenDocument Format odt files with sensitive content like credit card numbers, they often rely on built-in confidentiality markers or automatic data loss prevention features to flag these items appropriately. However, if the filename includes a hashtag character, the application fails to apply the expected confidential status tag to the document metadata. This discrepancy arises because the internal logic responsible for parsing filenames and applying security labels does not correctly account for special characters that may alter string processing routines or regex matching patterns used during file creation and classification processes.
From a technical perspective, this issue represents an input validation failure where the system assumes filename formats are strictly alphanumeric without considering edge cases involving symbols like hashes. In many enterprise environments, automated scanning tools and compliance frameworks depend on accurate metadata tagging to enforce retention policies, encryption requirements, or access controls. When a document is not marked as confidential due to this naming convention error, it bypasses these protective mechanisms entirely. Consequently, the file may be stored in less secure locations, shared without restriction, or archived with lower priority than intended, increasing the risk of unauthorized exposure.
This type of vulnerability aligns closely with CWE-20 Improper Input Validation and potentially CWE-755 Missing Information for Debugging if the lack of proper tagging hinders forensic analysis after a breach. It also relates to ATT&CK technique T1564 Hidden Files and Directories in terms of how data can be obscured from standard security monitoring tools that rely on metadata attributes rather than content inspection alone. The operational impact is significant because it undermines automated compliance workflows designed to protect personally identifiable information or financial records under regulations such as PCI DSS or GDPR.
Mitigation strategies should focus on enhancing input sanitization routines within document creation modules to ensure consistent handling of special characters in filenames regardless of their position or type. Developers must implement rigorous testing scenarios that include edge cases involving symbols, unicode characters, and unusual naming conventions to verify that metadata classification logic remains robust across all valid filename formats. Additionally, organizations should supplement automated tagging with manual review processes for high-sensitivity documents until software patches are deployed. Regular updates to office suite applications will address these parsing errors by correcting the underlying code paths responsible for associating filenames with security labels.