CVE-2024-22404: 
NixOS vulnerability analysis and mitigation

Nextcloud files Zip app, a tool for creating zip archives from files within Nextcloud, contains a vulnerability (CVE-2024-22404) that allows users to download 'view-only' files by zipping complete folders. This vulnerability affects versions prior to 1.2.1, 1.4.1, and 1.5.0 (Nextcloud Advisory).

The vulnerability stems from improper preservation of permissions in the Files ZIP application. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility with low attack complexity and required privileges (NVD).

The vulnerability allows users to bypass file access restrictions by downloading 'view-only' files through the zip functionality, potentially compromising data confidentiality (Nextcloud Advisory).

The vulnerability requires authenticated access to exploit, as users need to have access to the Nextcloud instance and the ability to interact with the Files ZIP application (NVD).

Users are recommended to upgrade the Files ZIP app to versions 1.2.1, 1.4.1, or 1.5.0. For those unable to upgrade immediately, the recommended workaround is to disable the Files ZIP app entirely (Nextcloud Advisory).