Vulnerability-Lookup

CERTFR-2025-AVI-0420

Vulnerability from certfr_avis - Published: 2025-05-16 - Updated: 2025-05-16

De multiples vulnérabilités ont été découvertes dans les produits Nextcloud. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Nextcloud	Groupfolders	Groupfolders versions 18.0.x antérieures à 18.0.3
Nextcloud	Groupfolders	Groupfolders versions 17.0.x antérieures à 17.0.5
Nextcloud	Enterprise Server	Enterprise Server versions 28.0.x antérieures à 28.0.14.6
Nextcloud	Enterprise Server	Enterprise Server versions 26.0.x antérieures à 26.0.13.15
Nextcloud	Desktop	Desktop versions antérieures à 3.15
Nextcloud	Server	Server versions 31.0.x antérieures à 31.0.3
Nextcloud	Enterprise Server	Enterprise Server versions 27.0.x antérieures à 27.1.11.15
Nextcloud	Enterprise Server	Enterprise Server versions 29.0.x antérieures à 29.0.15
Nextcloud	Enterprise Server	Enterprise Server versions 31.0.x antérieures à 31.0.3
Nextcloud	Server	Server versions 29.0.x antérieures à 29.0.15
Nextcloud	Enterprise Server	Enterprise Server versions 30.0.x antérieures à 30.0.9
Nextcloud	Groupfolders	Groupfolders versions 16.0.x antérieures à 16.0.11
Nextcloud	Server	Server versions 28.0.x antérieures à 28.0.13
Nextcloud	Server	Server versions 30.0.x antérieures à 30.0.9

References

Title

Publication Time

CVE-2025-47790 (GCVE-0-2025-47790)

Vulnerability from cvelistv5 – Published: 2025-05-16 14:02 – Updated: 2025-05-16 14:51

Title

Nextcloud Server doesn't request second factor after session timeout

Summary

Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with `remember_login_cookie_lifetime` set to `0`, once the session expired on the page to select the second factor and the page is reloaded. Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the `remember_login_cookie_lifetime` in config.php to a value other than `0`, e.g. `900`. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-16 14:50 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7668 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/nextcloud/security-advisories/…	x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/51905	x_refsource_MISC
https://hackerone.com/reports/2729367	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nextcloud	security-advisories	Affected: >= 26.0.0, < 26.0.13.15 Affected: >= 27.0.0, < 27.1.11.15 Affected: >= 28.0.0, < 28.0.14.6 Affected: >= 29.0.0, < 29.0.15 Affected: >= 30.0.0, < 30.0.9 Affected: >= 31.0.0, < 31.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47790",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-16T14:50:56.248971Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-16T14:51:08.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "security-advisories",
          "vendor": "nextcloud",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 26.0.0, \u003c 26.0.13.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 27.0.0, \u003c 27.1.11.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 28.0.0, \u003c 28.0.14.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 29.0.0, \u003c 29.0.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 30.0.0, \u003c 30.0.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 31.0.0, \u003c 31.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with `remember_login_cookie_lifetime` set to `0`, once the session expired on the page to select the second factor and the page is reloaded. Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the `remember_login_cookie_lifetime` in config.php to a value other than `0`, e.g. `900`. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-16T14:02:57.806Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9h3w-f3h4-qqrh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9h3w-f3h4-qqrh"
        },
        {
          "name": "https://github.com/nextcloud/server/pull/51905",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/server/pull/51905"
        },
        {
          "name": "https://hackerone.com/reports/2729367",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/2729367"
        }
      ],
      "source": {
        "advisory": "GHSA-9h3w-f3h4-qqrh",
        "discovery": "UNKNOWN"
      },
      "title": "Nextcloud Server doesn\u0027t request second factor after session timeout"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47790",
    "datePublished": "2025-05-16T14:02:57.806Z",
    "dateReserved": "2025-05-09T19:49:35.622Z",
    "dateUpdated": "2025-05-16T14:51:08.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-47791 (GCVE-0-2025-47791)

Vulnerability from cvelistv5 – Published: 2025-05-16 14:09 – Updated: 2025-05-16 14:50

Title

Nextcloud Server's test remote endpoint is not rate limited

Summary

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0.13, 29.0.10, and 30.0.3. No known workarounds are available.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-16 14:50 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7668 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nextcloud/security-advisories/…	x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/49558	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nextcloud	security-advisories	Affected: >= 28.0.0, < 28.0.13 Affected: >= 29.0.0, < 29.0.10 Affected: >= 30.0.0, < 30.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47791",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-16T14:50:33.786976Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-16T14:50:38.405Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "security-advisories",
          "vendor": "nextcloud",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 28.0.0, \u003c 28.0.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 29.0.0, \u003c 29.0.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 30.0.0, \u003c 30.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0.13, 29.0.10, and 30.0.3. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-16T14:09:27.322Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7vq-m7f8-rx37",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7vq-m7f8-rx37"
        },
        {
          "name": "https://github.com/nextcloud/server/pull/49558",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/server/pull/49558"
        }
      ],
      "source": {
        "advisory": "GHSA-c7vq-m7f8-rx37",
        "discovery": "UNKNOWN"
      },
      "title": "Nextcloud Server\u0027s test remote endpoint is not rate limited"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47791",
    "datePublished": "2025-05-16T14:09:27.322Z",
    "dateReserved": "2025-05-09T19:49:35.622Z",
    "dateUpdated": "2025-05-16T14:50:38.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-47792 (GCVE-0-2025-47792)

Vulnerability from cvelistv5 – Published: 2025-05-16 14:13 – Updated: 2025-05-16 14:27

Title

Nextcloud Desktop 3rdparty applications can create share links via socket API

Summary

Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-16 14:27 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7668 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/nextcloud/security-advisories/…	x_refsource_CONFIRM
https://github.com/nextcloud/desktop/pull/7517	x_refsource_MISC
https://hackerone.com/reports/1995856	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nextcloud	security-advisories	Affected: < 3.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47792",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-16T14:27:41.698126Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-16T14:27:53.727Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "security-advisories",
          "vendor": "nextcloud",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-16T14:13:53.209Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qm2f-959g-7p65",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qm2f-959g-7p65"
        },
        {
          "name": "https://github.com/nextcloud/desktop/pull/7517",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/desktop/pull/7517"
        },
        {
          "name": "https://hackerone.com/reports/1995856",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/1995856"
        }
      ],
      "source": {
        "advisory": "GHSA-qm2f-959g-7p65",
        "discovery": "UNKNOWN"
      },
      "title": "Nextcloud Desktop 3rdparty applications can create share links via socket API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47792",
    "datePublished": "2025-05-16T14:13:53.209Z",
    "dateReserved": "2025-05-09T19:49:35.622Z",
    "dateUpdated": "2025-05-16T14:27:53.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-47793 (GCVE-0-2025-47793)

Vulnerability from cvelistv5 – Published: 2025-05-16 14:31 – Updated: 2025-05-16 14:49

Title

Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file

Summary

Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed logged-in users to upload files exceeding the group folder quota. Nextcloud Server versions 30.0.2 and 29.0.9, Nextcloud Enterprise Server versions 30.0.2, 29.0.9, or 28.0.12, and Nextcloud Groupfolders app 18.0.3, 17.0.5, and 16.0.11 fix the issue. No known workarounds are available.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-16 14:49 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7668 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/nextcloud/security-advisories/…	x_refsource_CONFIRM
https://github.com/nextcloud/groupfolders/pull/3328	x_refsource_MISC
https://github.com/nextcloud/server/pull/48623	x_refsource_MISC
https://hackerone.com/reports/2713272	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nextcloud	security-advisories	Affected: >= 30.0.0, < 30.0.2 Affected: >= 29.0.0, < 29.0.9 Affected: >= 28.0.0, < 28.0.12 Affected: >= 18.0.0, < 18.0.3 Affected: >= 17.0.0, < 17.0.5 Affected: >= 16.0.0, < 16.0.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47793",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-16T14:49:00.953580Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-16T14:49:07.567Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "security-advisories",
          "vendor": "nextcloud",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 30.0.0, \u003c 30.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 29.0.0, \u003c 29.0.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 28.0.0, \u003c 28.0.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 18.0.0, \u003c 18.0.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 17.0.0, \u003c 17.0.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 16.0.0, \u003c 16.0.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed logged-in users to upload files exceeding the group folder quota. Nextcloud Server versions 30.0.2 and 29.0.9, Nextcloud Enterprise Server versions 30.0.2, 29.0.9, or 28.0.12, and Nextcloud Groupfolders app 18.0.3, 17.0.5, and 16.0.11 fix the issue. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-16T14:31:50.742Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qqgg-hhfq-vhww",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qqgg-hhfq-vhww"
        },
        {
          "name": "https://github.com/nextcloud/groupfolders/pull/3328",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/groupfolders/pull/3328"
        },
        {
          "name": "https://github.com/nextcloud/server/pull/48623",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/server/pull/48623"
        },
        {
          "name": "https://hackerone.com/reports/2713272",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/2713272"
        }
      ],
      "source": {
        "advisory": "GHSA-qqgg-hhfq-vhww",
        "discovery": "UNKNOWN"
      },
      "title": "Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47793",
    "datePublished": "2025-05-16T14:31:50.742Z",
    "dateReserved": "2025-05-09T19:49:35.622Z",
    "dateUpdated": "2025-05-16T14:49:07.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-47794 (GCVE-0-2025-47794)

Vulnerability from cvelistv5 – Published: 2025-05-16 14:35 – Updated: 2025-05-16 14:48

Title

Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission

Summary

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 fix the issue. No known workarounds are available.

Severity

2.6 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-16 14:48 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7668 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/nextcloud/security-advisories/…	x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/51194	x_refsource_MISC
https://hackerone.com/reports/1960647	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nextcloud	security-advisories	Affected: >= 26.0.0, < 26.0.13.13 Affected: >= 27.0.0, < 27.1.11.13 Affected: >= 28.0.0, < 28.0.14.4 Affected: >= 29.0.0, < 29.0.13 Affected: >= 30.0.0, < 30.0.7 Affected: >= 31.0.0, < 31.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47794",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-16T14:48:28.138559Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-16T14:48:34.016Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "security-advisories",
          "vendor": "nextcloud",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 26.0.0, \u003c 26.0.13.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 27.0.0, \u003c 27.1.11.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 28.0.0, \u003c 28.0.14.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 29.0.0, \u003c 29.0.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 30.0.0, \u003c 30.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 31.0.0, \u003c 31.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 fix the issue. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-16T14:35:25.280Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q568-2933-gcjq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q568-2933-gcjq"
        },
        {
          "name": "https://github.com/nextcloud/server/pull/51194",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/server/pull/51194"
        },
        {
          "name": "https://hackerone.com/reports/1960647",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/1960647"
        }
      ],
      "source": {
        "advisory": "GHSA-q568-2933-gcjq",
        "discovery": "UNKNOWN"
      },
      "title": "Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47794",
    "datePublished": "2025-05-16T14:35:25.280Z",
    "dateReserved": "2025-05-09T19:49:35.623Z",
    "dateUpdated": "2025-05-16T14:48:34.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CERTFR-2025-AVI-0420

Solutions

CVE-2025-47790 (GCVE-0-2025-47790)

CVE-2025-47791 (GCVE-0-2025-47791)

CVE-2025-47792 (GCVE-0-2025-47792)

CVE-2025-47793 (GCVE-0-2025-47793)

CVE-2025-47794 (GCVE-0-2025-47794)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour