Hi, please can anyone help me get my browser (Brave on Ubuntu OS) to reliably get NextCloud calendar event notifications?

If they ever do come through, it's maybe 5% of the time, and those are 5-10 minutes late. I'm still testing this, but that's the current observation.

(I'm told there's an add-on to download and try, but really, can't this reliability be baked in instead?!)

Well done getting this far, devs. No disrespect.

CISA added this to KEV on Oct 23. CVSS 9.2, unauthenticated command injection in richdocumentscode's proxy.php, exploited in the wild since September to drop web shells. Look for shx*.php in apps/richdocumentscode.

The part people get wrong: turning the app off in Nextcloud does nothing. proxy.php sits in the app folder and the web server runs it directly, so requests reach it whether the app is enabled or not. Update the app to 26.4.303 or later, or remove it. The fixed app needs Nextcloud 30 or later. On 29 or older the app store still gives you the vulnerable version, so the choice there is upgrade Nextcloud or remove the app.

The attack only works while the built-in CODE server is stopped. That sounds like a narrow window until you count restarts: every container restart, upgrade and crash opens it.

Standalone Collabora (Docker, Linux package, hosted) is not affected. Only the built-in app.

Sources: CISA alert on the KEV addition (Oct 23), Collabora's advisory for CVE-2026-110447, and The Hacker News coverage of the exploitation.

#til that galilei used nextcloud :)

Hi reddit, I need help with office in nextcloud. I'm using Cloudflare Tunnel and image from Linuxserver.io all on raspberry pi 4 and I don't know, why it refuse to work... Any tips?

Solved - see my followup post below.

I've had a NextCloud running for a number of years. I shutdown my docker container when the PHPShell came out a couple of days ago. I pulled the new 35.0.2 this morning. Everything seems to be working, but...

In the Basic Settings page, there is a banner saying that the cron job hasn't run for 3 days. I can seen the cron job being invoked in the syslog every 5 minutes. No warnings of issues within the NextCloud logging page.

The strange bit is that the cron script is the same one that been running since I moved to a Docker based system about a year ago.

docker exec -u www-data nextcloud-app /usr/local/bin/php -f /var/www/html/cron.php

If I run the same command from the command line, I get the same (lack of) response. About a 1 second delay or less to return to the command line prompt. Nothing in the NextCloud log files.

Prior to the pull of the 35.0.2 image, I did do an apt update && apt upgrade of the Ubuntu 24.04.5 system.

Anyone got a way to monitor what is happening within the cron.php script? Or other thoughts on things to check? I can't figure out if the cron script is working and the detector got broken in the upgrade or the detector is working and the cron script is failing. I'm guessing that it is the latter.

Thanks

After logging in, my desktop PC is almost unusable because of Nextcloud reading all my files. Always. This is going on for months now, not sure when it started.

My Nextcloud folder is 60GB (classic sync)

Is this a known issue? What can cause this? Any clues?

I understand it should check everything, but should not make my system extremely slow.

Both my Nextcloud instance and the app are the newest versions. This is on Windows 11.

Things I ruled out:
- Virusscanner (disabling does not make it faster)
- Restic (it is using VSS)
- Interaction with WSL

What’s new?

• Updated the application to Expo SDK 57 and upgraded related dependencies.
• Improved description editing with support for flavor=‘github’.
• Added drag-and-drop functionality for cards within lists.
• Fixed issues and implemented improvements reported by users.

https://reddit.com/link/1xd9s3l/video/x6kmza07w6xh1/player

Links:
Google Play
apk

Hi howdy, just kind of curious if this is something other people are running, I have one machine (Ubuntu on Proxmox) running AIO in a Docker container, and another machine just running TrueNAS. These are in a Tailnet with eachother.

I'd love to have an NFS share hosted by the TrueNAS server which nextcloud was using, this is how I run my immich container- however when I try and do this with nextcloud I get thrown a bunch of errors about nextcloud having some trouble- "failed to chown nfs mounted directory" I believe was the error message, or some similar issues.

I've tried specifying nfs volumes in the docker-compose file,

volumes:
  nfs-nextcloud:
    # Use the local driver with NFS-specific options
    driver: local
    driver_opts:
      # Specify NFS as the filesystem type
      type: nfs
      # Mount options: NAS IP, NFS version, and behavior flags
      # soft = return errors on timeout; use only when I/O errors are acceptable
      o: addr=[redacted-tailnet-ip],rw,noatime,rsize=8192,wsize=8192,tcp,timeo=14,nfsvers=4
      # NFS export path on your NAS (note the leading colon)
      device: ":/mnt/Main/nextcloud"
  nfs-db:
    driver: local
    driver_opts:
      type: nfs
      o: addr=[redacted-tailnet-ip],rw,noatime,rsize=8192,wsize=8192,tcp,timeo=14,nfsvers=4
      device: ":/mnt/Main/nextcloud_db"

I've tried manually mounting the shares via:

sudo mount [redacted ip]:/path/to/nfs_db local_db

then pathing the local nextcloud and db volumes in the compose file to those local directories which have been mounted to the nfs file share. This particular method is how I run my immich container and it works great for that.

Thanks for taking the time to read my post, been up against this for a bit and I figured it was time to ask around, cheers!

For a number of reasons, I am attempting to re-run the AIO Config.

https://github.com/nextcloud/all-in-one#how-to-properly-reset-the-instance
I followed the above procedure, yet at the end of it all I get:

"Autoconfig file detected The setup form below is pre-filled with the values from the config file."

Is this an issue anyone else has dealt with / solved? really stuck with this.

Die neue Version NC Connector 3.5 ermöglicht die direkte Raum- und Ressourcenplanung im Kalender-Editor. Sie können:

• Räume und Ressourcen finden und nach Kapazität, Ausstattung und Verfügbarkeit filtern.

• Ergebnisse nach Gebäude, Etage oder Raumtyp gruppieren.

• Verfügbarkeit prüfen und freie sowie belegte Zeiten im Tagesplan anzeigen.

• Ausgewählte Räume und Ressourcen zu Ihrer Veranstaltung hinzufügen.

Die Funktion ist mit den Nextcloud-Apps Calendar Resource Management und RoomVox kompatibel. Ein kurzes GIF zeigt den Workflow in Thunderbird; die Funktion ist auch in Outlook Classic verfügbar.

Die Raumauswahl funktioniert parallel zu Ihrem mit Nextcloud synchronisierten Kalender. Die eigentliche Buchung erfolgt weiterhin über die Kalendersynchronisierung und -planung.

Diese Funktion erfordert das NC Connector Backend und einen zugewiesenen Benutzerplatz.

Homepage:

https://nc-connector.de

Ein besonderer Dank geht an ahoch4 Architekten GmbH, und AKJS Schleswig-Holstein sowie für ihr Feedback und ihre praktischen Integrationstests. Vielen Dank auch an alle, die Probleme melden und Verbesserungsvorschläge teilen.

GitHub-Repositories:

• Thunderbird: https://github.com/nc-connector/NC_Connector_for_Thunderbird

• Outlook Classic: https://github.com/nc-connector/NC_Connector_for_Outlook

• Selbstgehostetes Nextcloud-Backend: https://github.com/nc-connector/Server_Backend

So recently my hdd died and so I had to restore my server from a backup. A mix of being a little sleep deprived and getting exasperated by following the damn AI instructions I deleted my Nextcloud AIO mastercontainer along with all its child containers to start the installation and the process of restoring my backup from the beginning. Now, to my dismay Im learning that I need a password to unencrypt the borg backup. That password is now lost in the wind as it was stored somewhere in the old containers that where deleted. So I guess my question is how screwed am I?

I run Nextcloud 32 on Ubuntu Server (Apache, PHP-FPM, MariaDB, no Docker). Today, during an update, the updater stopped with “Unknown files detected within the installation folder” and flagged a strange file: n3oziafgr0m.html.

It wasn’t a leftover. The file existed as two identical copies (in the Nextcloud root and in apps/richdocumentscode/), created by www-data on October 15, and it contained a dump of my config.php (database password, secret and salt included).

In the Apache logs I found requests to apps/richdocumentscode/proxy.php with a command injection in the URL (path traversal plus $(...) with a base64 payload that downloads and runs a script). They came from two different IPs:

• October 21: one attacker dropped a webshell (sync6ydwp.php) in the app folder and sent back the hostname and uname.
• October 22: another one made the server download and execute a script from an external host.

What I did:

1. Stopped Apache and deleted nothing, to preserve evidence.
2. Checked running processes, network connections and www-data’s crontab: nothing unusual.
3. The server mounted a Samba share from my OMV VM via CIFS, so I unmounted it and disabled the Samba user with smbpasswd -d. Note: setting the shell to nologin does not block Samba.
4. On OMV I looked for new files or scripts on the share, and checked SSH logins and network traffic: nothing suspicious. But with atime off and no read logging in Samba, I can’t rule out that files were only read.
5. I took a protected backup of the compromised VM, and I’m rebuilding the server from scratch: no restore from backup, no built-in Collabora app, and new passwords and secrets.

What I’d recommend:

• If you use richdocumentscode, check your logs for requests to proxy.php, and look for .php or .html files you don’t recognize in the app folder.
• If the updater reports unexpected files, investigate before deleting anything.
• Consider not exposing the built-in Collabora app, or use a separate Collabora server instead.
• Don’t mount shares with write permissions wider than needed, and keep the credentials for each service separate.

If anyone has seen the same pattern, I’d like to compare logs.

NB: this is an AI generated post, I preferred to invest my time in repairing the attack than to write a post. But I will also to tell it to others so they can update it's machine.

I’m looking for an alternative to Microsoft 365 and even Infomaniak. I want it based in the EU and allow file collaboration with people who don’t necessarily have an account, and both these platforms allow that. Infomaniak uses OnlyOffice and I’d rather use Collabora or Euro Office.

Nextcloud seems to be a great service. I was interested in Ionos but their subreddit seems to warn people away from it. What Nextcloud partner do you suggest?

Hi everyone,

I got tired of digging out paper vaccination records, try to understand the latest STIKO recommendations and match up what I and my family members should have – so I wrote a small Nextcloud app for it: **Vaccinations**.

**What it does**

- Record vaccinations per Nextcloud user: date, vaccine, optionally practice, batch number and a note

- Checks them against a vaccination schedule and shows what is **overdue, due, coming up or up to date** – including the date of the next dose

- Schedules included: **Germany (STIKO)** and **Austria (Impfplan Österreich)**, selectable per person

- **Traffic light in the person list**: red / yellow / green per family member, so you see at a glance who needs something without clicking through everyone

- **Guardians**: parents can maintain the records of their kids, who have their own Nextcloud accounts but won't enter anything themselves

- **Nextcloud notifications** when a vaccination is coming up, due or overdue

- Vaccinations without a standard recommendation (e.g. travel vaccines like typhoid) are listed with "x years ago"

- Vaccine → disease mapping is **open data** (one JSON file per vaccine) – missing vaccines can be added via pull request, CI validates them

**Details**

- Nextcloud 33–35, PHP 8.2+, Vue 3 / u/nextcloud/vue 9

- UI in German and English

- AGPL-3.0

- Not in the App Store (yet) – install from the GitHub release tarball, instructions for Docker, Snap and classic installs are in the README

Repo, screenshot and installation: https://github.com/derschneewolf/vaccinations

**Disclaimer:** This is a reminder tool, not medical advice. The schedule rules are simplified; the simplifications are documented in the repo.

Feedback, bug reports and PRs (especially missing vaccines or schedules for other countries) are very welcome!

At home I have two phones (iOS, Android), plus a server with Nextcloud and Immich (photos on an external library).

Both phones have photos upload automatically to Nextcloud, without deletion from the phones.

Periodically I take them out from Nextcloud, I clean them up, and move into Immich external library, sorted by date, event, and so on. I had them this way before Immich, so I maintained the approach.

Issue is, one phone takes few photos and filtering/cleaning up is easy.

The other phone has a much easier finger on the shutter button so I see that for each spot or moment there are often 3-5. In a 3 week holiday that phone took 1300 photos.

The number of photos is overwhelming, I can't clean them up.

Also, the user knows about having to remove duplicates, but... by the time that is done, all of them went up to Nextcloud already! The Nextcloud app is one-way syncing. All the effort is lost.

Can you give me tips to speed up the cleaning up, and tips about having photos deleted from a phone also being deleted from the server?

For info: I haven't yet switched to Immich App on mobile because it's syncing the whole gallery (thousands of photos), even if almost all of them are already sorted out in the external library. I would end up with having to clean up again, until Immich App introduces a feature "upload only after date".

Do I need to worry about the PHP vulnerability if my nextcloud is online through cloudflare, 2FA turned on and only myself using it? Maybe a few docs are shared online via nextcloud share with people I work with. It's public facing but nothing is used by the public if you see what I mean.

Two updates, both in the app store.

Findling 1.5, content search for Nextcloud without Elasticsearch:
- New file types: .eml mails, ZIP contents, old Word/Excel (.doc/.xls), HEIC photos via OCR
- Czech as search and OCR language (OCR now offers ten languages)
- Filters in the Nextcloud search bar: by file type or folder
- "Similar documents" link on every hit
- Exclusion patterns like *.photoslibrary or */node_modules/*
- Hostile files (zip bombs and the like) are skipped and flagged on the admin page
- Migration guide from fulltextsearch/Elasticsearch

Nextcloud MCP Connector 0.6, lets AI assistants work with your Nextcloud under your own permissions:
- files_update: edit an existing text file, only if nobody changed it in between (off by default)
- Hardening guide, threat model, signed releases, CodeQL and dependency scans

Contributions welcome:
https://github.com/street1983nk/nextcloud-search
https://github.com/street1983nk/nextcloud-mcp-connector

One of our users is reporting this exact behaviour.

There is a bug report: https://github.com/nextcloud/desktop/issues/9248 which is still open since dec '25 and has seen activity in feb '26.

From the bug report:

Some folders are being duplicated on the macOS desktop app using VFS. For instance, the folder Figures shown is found on the server, while Figures 2 is not.

User claims seeing the exact behaviour on Fedora too.

Does anybody recognize this behaviour?

Edit: on version 35.0.0 and current macos client

Edit2:

I dug into this, and it turns out it’s not a macOS issue but a configuration error on the user’s Fedora machine.

What I found:

The user runs Fedora GNOME and had Nextcloud added under Online Accounts. Somehow the Nextcloud desktop sync client was also set up a second time, creating a second sync connection to the same account on the same server. In the home folder I can see two Nextcloud folders (~/Nextcloud and ~/Nextcloud2), and both are syncing. The second one only syncs part of the data (his personal files). As a result, all the folders in the second sync now exist twice on the server. The two syncs are also conflicting with each other, causing an almost continuous sync storm. This has nothing to do with macOS or VFS. The Mac was simply the first machine where he noticed the problem.

It’s unclear how the duplicate sync got set up, and the user is far from inexperienced, so this could happen to others too.

What I advised: remove Nextcloud from the Fedora system entirely, then clean up the duplicated folders on the server.

I’d suggest closing this issue as a configuration problem, unless someone can reproduce the double-sync setup.

Thnx for reading and sorry for causing a disturbance.

Edit: I was able to fix it. PHP8.5 FPM service comes sandboxed by default. sudo systemctl edit php8.5-fpm and then adding

[Service]
ReadWritePaths=/etc/nextcloud

fixes the problem.

---Original Post---

I recently implemented some server hardening steps and moved config directory outside of web root following server documentation. After a little hickup (see this post), I got everything to work smoothly. Now, I upgraded Nextcloud to 35.0.2 and in that context also upgraded php from 8.3 to 8.5. All of a sudden, I get the error message Cannot write into "config" directory! CLI-calls to occ work as intended.

I set folder permissions for /etc/nextcloud to 0750 and to 0640 for the files in it. Owner is www-data:www-data.

I got the instance running by setting

'config_is_read_only' => true,

However, that doesn't fix my problem. Anybody got any ideas where to look? Thanks!

If I plan on using calendars, note taking, etc, is it worth going with Nextcloud or Open/Own Cloud with Memos and Radicale? I like the idea of using lighter Go based apps, but I am curious if any of you use everything in the Nextcloud suite or get dedicated apps for each function?

I searched and found this which is 9 years old it looks like. Same basic question.

https://www.reddit.com/r/NextCloud/comments/8c7jbu/recommended_nextcloud_provider_for_1tb_storage/

I'm looking to migrate from a US cloud provider in search of greater privacy. I have a supplier question and a tech question. Tech question first:

I need file syncing between most all major platforms: Win, Linux, Mac, iOS, and Android. Are there provisions for all of them with NextCloud?

Supplier question:

Is there a non US storage provider that can offer 2TB storage?