← Back

CVE-2025-47791

nvd nist
Published: May 16, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0.13, 29.0.10, and 30.0.3. No known workarounds are available.

Affected (6)

Nextcloud
1 product
Nextcloud Server
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Nextcloud
Nextcloud Server
From 28.0.0 to 28.0.13
Nextcloud Server
From 29.0.0 to 29.0.10
Nextcloud Server
From 30.0.0 to 30.0.3
Nextcloud Server
From 28.0.0 to 28.0.13
Nextcloud Server
From 29.0.0 to 29.0.10
Nextcloud Server
From 30.0.0 to 30.0.3

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
Patch

Timeline

No history available yet.