Nextcloud v35.0.1 released on 24-09-2026
Nextcloud v35.0.1 is out now. Administrators should upgrade immediately to address several security vulnerabilities affecting the server web UI and sharing code, to harden request validation against CSRF/XSS patterns, and to tighten file access checks.
For full details and official upgrade instructions consult the release notes on GitHub and follow the release thread for any post-upgrade reports.
What’s in this release
- Security fixes: multiple vulnerabilities in the server web UI and sharing code, improved request validation for CSRF/XSS mitigation, and tighter file access checks.
- File handling and sync fixes: resolved file-locking and race conditions, corrections to file versioning and trash handling, and improved sync client compatibility and background job reliability.
- Performance, stability and compatibility: query optimisations to reduce load and memory usage, fixes for memory leaks and long-running background jobs, and tweaks to improve compatibility with current PHP and MariaDB/Postgres versions.
Upgrade notes
- Back up your instance and test the upgrade on a staging system first; run the recommended occ maintenance commands and check for stale or incompatible third-party apps before upgrading.
- If a rollback becomes necessary, restore from your backup and follow the rollback guidance linked from the GitHub release; verify desktop/mobile sync and search results after restoring.
Share any notes or problems you encounter after upgrading on the GitHub release thread so others can see real-world impact and workarounds.
