Vulnerability-Lookup

CVE-2025-59788 (GCVE-0-2025-59788)

Vulnerability from cvelistv5 – Published: 2025-12-04 00:00 – Updated: 2025-12-11 15:04

Summary

Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-05 17:20 UTC

CWE

CWE-749 - Exposed Dangerous Method or Function

Assigner

mitre CNA under the mitre root

CNA scorecard E 29/100 over 2369 records in the last 180 days details

References

3 references

URL	Tags
https://nextcloud.com
https://www.redteam-pentesting.de/en/advisories/r…
https://github.com/nextcloud/security-advisories/…

Impacted products

1 product

Vendor	Product	Version	CPE status
Nextcloud	Nextcloud	Affected: 0 , < 22.2.10.33 (custom) Affected: 23 , < 23.0.12.29 (custom) Affected: 24 , < 24.0.12.28 (custom) Affected: 25 , < 25.0.13.23 (custom) Affected: 26 , < 26.0.13.20 (custom) Affected: 27 , < 27.1.11.20 (custom) Affected: 28 , < 28.0.14.11 (custom) Affected: 29 , < 29.0.16.8 (custom) Affected: 30 , < 30.0.17 (custom) Affected: 31 , < 31.0.10 (custom) Affected: 32 , < 32.0.1 (custom) cpe:2.3:a:nextcloud:nextcloud:::::::: cpe:2.3:a:nextcloud:nextcloud:::::::: cpe:2.3:a:nextcloud:nextcloud:::::::: cpe:2.3:a:nextcloud:nextcloud:::::::: cpe:2.3:a:nextcloud:nextcloud:::::::: cpe:2.3:a:nextcloud:nextcloud:::::::: cpe:2.3:a:nextcloud:nextcloud:::::::: cpe:2.3:a:nextcloud:nextcloud:::::::: cpe:2.3:a:nextcloud:nextcloud:::::::: cpe:2.3:a:nextcloud:nextcloud:::::::: cpe:2.3:a:nextcloud:nextcloud::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59788",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-05T17:20:13.836811Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T15:04:25.726Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Nextcloud",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThan": "22.2.10.33",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "23.0.12.29",
              "status": "affected",
              "version": "23",
              "versionType": "custom"
            },
            {
              "lessThan": "24.0.12.28",
              "status": "affected",
              "version": "24",
              "versionType": "custom"
            },
            {
              "lessThan": "25.0.13.23",
              "status": "affected",
              "version": "25",
              "versionType": "custom"
            },
            {
              "lessThan": "26.0.13.20",
              "status": "affected",
              "version": "26",
              "versionType": "custom"
            },
            {
              "lessThan": "27.1.11.20",
              "status": "affected",
              "version": "27",
              "versionType": "custom"
            },
            {
              "lessThan": "28.0.14.11",
              "status": "affected",
              "version": "28",
              "versionType": "custom"
            },
            {
              "lessThan": "29.0.16.8",
              "status": "affected",
              "version": "29",
              "versionType": "custom"
            },
            {
              "lessThan": "30.0.17",
              "status": "affected",
              "version": "30",
              "versionType": "custom"
            },
            {
              "lessThan": "31.0.10",
              "status": "affected",
              "version": "31",
              "versionType": "custom"
            },
            {
              "lessThan": "32.0.1",
              "status": "affected",
              "version": "32",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "22.2.10.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "23.0.12.29",
                  "versionStartIncluding": "23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "24.0.12.28",
                  "versionStartIncluding": "24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "25.0.13.23",
                  "versionStartIncluding": "25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "26.0.13.20",
                  "versionStartIncluding": "26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "27.1.11.20",
                  "versionStartIncluding": "27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "28.0.14.11",
                  "versionStartIncluding": "28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "29.0.16.8",
                  "versionStartIncluding": "29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "30.0.17",
                  "versionStartIncluding": "30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "31.0.10",
                  "versionStartIncluding": "31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "32.0.1",
                  "versionStartIncluding": "32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user\u0027s browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749 Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-04T19:02:03.447Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://nextcloud.com"
        },
        {
          "url": "https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/"
        },
        {
          "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-59788",
    "datePublished": "2025-12-04T00:00:00.000Z",
    "dateReserved": "2025-09-19T00:00:00.000Z",
    "dateUpdated": "2025-12-11T15:04:25.726Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-59788",
      "date": "2026-10-23",
      "epss": "0.00302",
      "percentile": "0.21796"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Nextcloud",
                "vendor": "Nextcloud",
                "versions": [
                  {
                    "lessThan": "22.2.10.33",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "23.0.12.29",
                    "status": "affected",
                    "version": "23",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "24.0.12.28",
                    "status": "affected",
                    "version": "24",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "25.0.13.23",
                    "status": "affected",
                    "version": "25",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "26.0.13.20",
                    "status": "affected",
                    "version": "26",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "27.1.11.20",
                    "status": "affected",
                    "version": "27",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "28.0.14.11",
                    "status": "affected",
                    "version": "28",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "29.0.16.8",
                    "status": "affected",
                    "version": "29",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "30.0.17",
                    "status": "affected",
                    "version": "30",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "31.0.10",
                    "status": "affected",
                    "version": "31",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "32.0.1",
                    "status": "affected",
                    "version": "32",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "cve@mitre.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
                    "matchCriteriaId": "8A3D94EC-A877-458D-9A33-5451FE97A785",
                    "versionEndExcluding": "30.0.17",
                    "versionStartIncluding": "30.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
                    "matchCriteriaId": "2059C891-F256-482A-99BF-D912A1657419",
                    "versionEndExcluding": "31.0.10",
                    "versionStartIncluding": "31.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
                    "matchCriteriaId": "A75D466C-B154-480A-9D4F-8E9454147156",
                    "versionEndExcluding": "32.0.1",
                    "versionStartIncluding": "32.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "4440D2E7-2FCB-4CC2-A57F-708AAB0CD22B",
                    "versionEndExcluding": "22.2.10.33",
                    "versionStartIncluding": "22.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "51922DA7-3112-422A-9F66-9CAA54E89D8F",
                    "versionEndExcluding": "23.0.12.29",
                    "versionStartIncluding": "23.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "6AC7C575-7348-45A1-9023-A6606541987B",
                    "versionEndExcluding": "24.0.12.28",
                    "versionStartIncluding": "24.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "000C64D7-C76D-4E69-9705-18132C615456",
                    "versionEndExcluding": "25.0.13.23",
                    "versionStartIncluding": "25.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "D9491A91-2A7C-4C84-89E9-219422D91350",
                    "versionEndExcluding": "26.0.13.20",
                    "versionStartIncluding": "26.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "CFD3A15F-58D7-4C3D-A49F-065F28ED6361",
                    "versionEndExcluding": "27.1.11.20",
                    "versionStartIncluding": "27.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "B55EF258-E98A-43A9-B73C-AE62D448421D",
                    "versionEndExcluding": "28.0.14.11",
                    "versionStartIncluding": "28.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "7710228F-2984-4F9A-8360-0054E7E78687",
                    "versionEndExcluding": "29.0.16.8",
                    "versionStartIncluding": "29.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "AE19F75F-6A78-4770-B7C6-338570FA7184",
                    "versionEndExcluding": "30.0.17",
                    "versionStartIncluding": "30.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "64C21E45-22B8-49B2-B630-30448D89A4E9",
                    "versionEndExcluding": "31.0.10",
                    "versionStartIncluding": "31.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "CFA5AD5D-1145-44D6-ABE3-64837C74975F",
                    "versionEndExcluding": "32.0.1",
                    "versionStartIncluding": "32.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user\u0027s browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de cross-site scripting (XSS) en un directorio de ejemplo files_pdfviewer accesible en Nextcloud con versiones anteriores a 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10 y 32.0.1 permite a los atacantes ejecutar JavaScript arbitrario en el contexto del navegador de un usuario a trav\u00e9s de un archivo PDF manipulado a viewer.html. Este problema est\u00e1 relacionado con CVE-2024-4367, pero la causa ra\u00edz de este problema de Nextcloud es que el producto expone c\u00f3digo de ejemplo ejecutable sobre una base de mismo origen."
          }
        ],
        "id": "CVE-2025-59788",
        "lastModified": "2026-10-18T15:10:00.097",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 2.7,
              "source": "cve@mitre.org",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-59788",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-05T17:20:13.836811Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-04T19:16:04.380",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Product"
            ],
            "url": "https://nextcloud.com"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-749"
              }
            ],
            "source": "cve@mitre.org",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-28T11:47:38+00:00",
      "cve": "CVE-2025-59788",
      "id": "CVE-2025-59788",
      "initial_release_date": "2025-12-04T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Nextcloud: Nextcloud: Cross-site scripting (XSS) in PDF viewer allows arbitrary JavaScript execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59788.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-59788",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-12-05T17:20:13.836811Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-12-05T17:20:02.577Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Nextcloud",
              "vendor": "Nextcloud",
              "versions": [
                {
                  "lessThan": "22.2.10.33",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "23.0.12.29",
                  "status": "affected",
                  "version": "23",
                  "versionType": "custom"
                },
                {
                  "lessThan": "24.0.12.28",
                  "status": "affected",
                  "version": "24",
                  "versionType": "custom"
                },
                {
                  "lessThan": "25.0.13.23",
                  "status": "affected",
                  "version": "25",
                  "versionType": "custom"
                },
                {
                  "lessThan": "26.0.13.20",
                  "status": "affected",
                  "version": "26",
                  "versionType": "custom"
                },
                {
                  "lessThan": "27.1.11.20",
                  "status": "affected",
                  "version": "27",
                  "versionType": "custom"
                },
                {
                  "lessThan": "28.0.14.11",
                  "status": "affected",
                  "version": "28",
                  "versionType": "custom"
                },
                {
                  "lessThan": "29.0.16.8",
                  "status": "affected",
                  "version": "29",
                  "versionType": "custom"
                },
                {
                  "lessThan": "30.0.17",
                  "status": "affected",
                  "version": "30",
                  "versionType": "custom"
                },
                {
                  "lessThan": "31.0.10",
                  "status": "affected",
                  "version": "31",
                  "versionType": "custom"
                },
                {
                  "lessThan": "32.0.1",
                  "status": "affected",
                  "version": "32",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "22.2.10.33",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "23.0.12.29",
                      "versionStartIncluding": "23",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "24.0.12.28",
                      "versionStartIncluding": "24",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "25.0.13.23",
                      "versionStartIncluding": "25",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "26.0.13.20",
                      "versionStartIncluding": "26",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "27.1.11.20",
                      "versionStartIncluding": "27",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "28.0.14.11",
                      "versionStartIncluding": "28",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "29.0.16.8",
                      "versionStartIncluding": "29",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "30.0.17",
                      "versionStartIncluding": "30",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "31.0.10",
                      "versionStartIncluding": "31",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "32.0.1",
                      "versionStartIncluding": "32",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user\u0027s browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 6.4,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-749",
                  "description": "CWE-749 Exposed Dangerous Method or Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-12-04T19:02:03.447Z",
            "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            "shortName": "mitre"
          },
          "references": [
            {
              "url": "https://nextcloud.com"
            },
            {
              "url": "https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/"
            },
            {
              "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r"
            }
          ],
          "x_generator": {
            "engine": "enrichogram 0.0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "assignerShortName": "mitre",
        "cveId": "CVE-2025-59788",
        "datePublished": "2025-12-04T00:00:00.000Z",
        "dateReserved": "2025-09-19T00:00:00.000Z",
        "dateUpdated": "2025-12-11T15:04:25.726Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2026-07783 (CVE-2025-59788)

Vulnerability from fstec – Published: 2026-06-04 – Updated: 2026-06-29 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Summary

Уязвимость приложения для интеграции библиотеки PDF.js files_pdfviewer облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server связанная с недостаточной защитой структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, проводить межсайтовые сценарные атаки (XSS)

Severity

6.5 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:S/C:P/I:P/A:P

5.5 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Injection

Incidents

Being clarified

Remediation

Software update

CWE

CWE-79 - Непринятие мер по защите структуры веб-страницы (или \«Межсайтовая сценарная атака\»)

Aliases

CVE-2025-59788, GHSA-24WP-P865-7J4R

References

2 references

URL
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-…
https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/

Impacted products

5 products from 3 vendors

Vendors

Fedora Project, ООО «Ред Софт», Nextcloud GmbH

Products

Fedora, Fedora EPEL, РЕД ОС (запись в едином реестре российских программ №3751), Nextcloud Server, Nextcloud Enterprise Server

Versions

42 (Fedora), epel10 (Fedora EPEL), 43 (Fedora), 8.0 (РЕД ОС), до 31.0.10 (Nextcloud Server), до 32.0.1 (Nextcloud Server), до 28.0.14.11 (Nextcloud Enterprise Server), до 29.0.16.8 (Nextcloud Enterprise Server), до 30.0.17 (Nextcloud Server), до 22.2.10.33 (Nextcloud Enterprise Server), до 23.0.12.29 (Nextcloud Enterprise Server), до 24.0.12.28 (Nextcloud Enterprise Server), до 25.0.13.23 (Nextcloud Enterprise Server), до 26.0.13.20 (Nextcloud Enterprise Server), до 27.1.11.20 (Nextcloud Enterprise Server), до 30.0.17 (Nextcloud Enterprise Server), до 32.0.1 (Nextcloud Enterprise Server)

Product types

Operating system, Application software

Platforms

Fedora Project Fedora 42, Fedora Project Fedora 43, ООО «Ред Софт» РЕД ОС 8.0 (запись в едином реестре российских программ №3751)

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Nextcloud Server: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r Для Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-59788 Для Ред ОС: http://repo.red-soft.ru/redos/8.0/x86_64/updates/

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Fedora Project, \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, Nextcloud GmbH",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "42 (Fedora), epel10 (Fedora EPEL), 43 (Fedora), 8.0 (\u0420\u0415\u0414 \u041e\u0421), \u0434\u043e 31.0.10 (Nextcloud Server), \u0434\u043e 32.0.1 (Nextcloud Server), \u0434\u043e 28.0.14.11 (Nextcloud Enterprise Server), \u0434\u043e 29.0.16.8 (Nextcloud Enterprise Server), \u0434\u043e 30.0.17 (Nextcloud Server), \u0434\u043e 22.2.10.33 (Nextcloud Enterprise Server), \u0434\u043e 23.0.12.29 (Nextcloud Enterprise Server), \u0434\u043e 24.0.12.28 (Nextcloud Enterprise Server), \u0434\u043e 25.0.13.23 (Nextcloud Enterprise Server), \u0434\u043e 26.0.13.20 (Nextcloud Enterprise Server), \u0434\u043e 27.1.11.20 (Nextcloud Enterprise Server), \u0434\u043e 30.0.17 (Nextcloud Enterprise Server), \u0434\u043e 32.0.1 (Nextcloud Enterprise Server)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Nextcloud Server:\nhttps://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r\n\n\u0414\u043b\u044f Fedora:\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-59788\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421: \nhttp://repo.red-soft.ru/redos/8.0/x86_64/updates/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "03.09.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "29.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "04.06.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-07783",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-59788, GHSA-24wp-p865-7j4r",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Fedora, Fedora EPEL, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Nextcloud Server, Nextcloud Enterprise Server",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Fedora Project Fedora 42 , Fedora Project Fedora 43 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 PDF.js files_pdfviewer \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 Nextcloud Server, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u044b\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 (XSS)",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435 \u043c\u0435\u0440 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b (\u0438\u043b\u0438 \\\u00ab\u041c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u0430\u044f \u0441\u0446\u0435\u043d\u0430\u0440\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430\\\u00bb) (CWE-79)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 PDF.js files_pdfviewer \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 Nextcloud Server \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u044b\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 (XSS)",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r\nhttps://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-79",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,5)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,5)"
}

FKIE_CVE-2025-59788

Vulnerability from fkie_nvd - Published: 2025-12-04 19:16 - Updated: 2026-10-18 15:10

Severity

6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
cve@mitre.org	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r	Mitigation, Vendor Advisory
cve@mitre.org	https://nextcloud.com	Product
cve@mitre.org	https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/	Exploit, Third Party Advisory

Impacted products

Vendor	Product	Version
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*
nextcloud	nextcloud_server	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Nextcloud",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThan": "22.2.10.33",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "23.0.12.29",
              "status": "affected",
              "version": "23",
              "versionType": "custom"
            },
            {
              "lessThan": "24.0.12.28",
              "status": "affected",
              "version": "24",
              "versionType": "custom"
            },
            {
              "lessThan": "25.0.13.23",
              "status": "affected",
              "version": "25",
              "versionType": "custom"
            },
            {
              "lessThan": "26.0.13.20",
              "status": "affected",
              "version": "26",
              "versionType": "custom"
            },
            {
              "lessThan": "27.1.11.20",
              "status": "affected",
              "version": "27",
              "versionType": "custom"
            },
            {
              "lessThan": "28.0.14.11",
              "status": "affected",
              "version": "28",
              "versionType": "custom"
            },
            {
              "lessThan": "29.0.16.8",
              "status": "affected",
              "version": "29",
              "versionType": "custom"
            },
            {
              "lessThan": "30.0.17",
              "status": "affected",
              "version": "30",
              "versionType": "custom"
            },
            {
              "lessThan": "31.0.10",
              "status": "affected",
              "version": "31",
              "versionType": "custom"
            },
            {
              "lessThan": "32.0.1",
              "status": "affected",
              "version": "32",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "8A3D94EC-A877-458D-9A33-5451FE97A785",
              "versionEndExcluding": "30.0.17",
              "versionStartIncluding": "30.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "2059C891-F256-482A-99BF-D912A1657419",
              "versionEndExcluding": "31.0.10",
              "versionStartIncluding": "31.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "A75D466C-B154-480A-9D4F-8E9454147156",
              "versionEndExcluding": "32.0.1",
              "versionStartIncluding": "32.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "4440D2E7-2FCB-4CC2-A57F-708AAB0CD22B",
              "versionEndExcluding": "22.2.10.33",
              "versionStartIncluding": "22.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "51922DA7-3112-422A-9F66-9CAA54E89D8F",
              "versionEndExcluding": "23.0.12.29",
              "versionStartIncluding": "23.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "6AC7C575-7348-45A1-9023-A6606541987B",
              "versionEndExcluding": "24.0.12.28",
              "versionStartIncluding": "24.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "000C64D7-C76D-4E69-9705-18132C615456",
              "versionEndExcluding": "25.0.13.23",
              "versionStartIncluding": "25.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "D9491A91-2A7C-4C84-89E9-219422D91350",
              "versionEndExcluding": "26.0.13.20",
              "versionStartIncluding": "26.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "CFD3A15F-58D7-4C3D-A49F-065F28ED6361",
              "versionEndExcluding": "27.1.11.20",
              "versionStartIncluding": "27.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B55EF258-E98A-43A9-B73C-AE62D448421D",
              "versionEndExcluding": "28.0.14.11",
              "versionStartIncluding": "28.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "7710228F-2984-4F9A-8360-0054E7E78687",
              "versionEndExcluding": "29.0.16.8",
              "versionStartIncluding": "29.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "AE19F75F-6A78-4770-B7C6-338570FA7184",
              "versionEndExcluding": "30.0.17",
              "versionStartIncluding": "30.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "64C21E45-22B8-49B2-B630-30448D89A4E9",
              "versionEndExcluding": "31.0.10",
              "versionStartIncluding": "31.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "CFA5AD5D-1145-44D6-ABE3-64837C74975F",
              "versionEndExcluding": "32.0.1",
              "versionStartIncluding": "32.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user\u0027s browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de cross-site scripting (XSS) en un directorio de ejemplo files_pdfviewer accesible en Nextcloud con versiones anteriores a 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10 y 32.0.1 permite a los atacantes ejecutar JavaScript arbitrario en el contexto del navegador de un usuario a trav\u00e9s de un archivo PDF manipulado a viewer.html. Este problema est\u00e1 relacionado con CVE-2024-4367, pero la causa ra\u00edz de este problema de Nextcloud es que el producto expone c\u00f3digo de ejemplo ejecutable sobre una base de mismo origen."
    }
  ],
  "id": "CVE-2025-59788",
  "lastModified": "2026-10-18T15:10:00.097",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.7,
        "source": "cve@mitre.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-59788",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-05T17:20:13.836811Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-04T19:16:04.380",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://nextcloud.com"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-749"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-88CV-G9GQ-H6PQ

Vulnerability from github – Published: 2025-12-04 21:31 – Updated: 2025-12-04 21:31

Details

Severity

6.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-59788"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749",
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-04T19:16:04Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user\u0027s browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.",
  "id": "GHSA-88cv-g9gq-h6pq",
  "modified": "2025-12-04T21:31:04Z",
  "published": "2025-12-04T21:31:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59788"
    },
    {
      "type": "WEB",
      "url": "https://nextcloud.com"
    },
    {
      "type": "WEB",
      "url": "https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2025-2739

Vulnerability from csaf_certbund - Published: 2025-12-03 23:00 - Updated: 2025-12-04 23:00

Summary

Nextcloud: Schwachstelle ermöglicht Cross-Site Scripting

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2025-59788.

CVE-2025-59788

Known affected: 11 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-59788 (GCVE-0-2025-59788)

BDU:2026-07783 (CVE-2025-59788)

FKIE_CVE-2025-59788

GHSA-88CV-G9GQ-H6PQ

WID-SEC-W-2025-2739

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour