The Photos app in Nextcloud Server has a flaw in its smart album feature where the file listing is generated based on the folder configuration of the user viewing the album rather than the album owner's configuration. This causes the viewer to see metadata (file name, file ID, and other metadata) of files in folders that the album owner did not intend to include in the shared album. The vulnerability requires that the album owner has shared a filter-based smart album with the attacker, so it does not permit arbitrary file access without such sharing.

An attacker who has been shared a filter-based smart album by the album owner can discover metadata about files in folders that the owner did not intend to share. This could lead to unintended disclosure of file names, file IDs, and other metadata, potentially exposing sensitive information about the owner's file structure. There is no indication that file contents can be accessed or modified, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Nextcloud advisories for updates. Until a fix is available, users should be cautious when sharing filter-based smart albums and consider limiting sharing to trusted users only.