CVE-2025-58051

Published: Oct 16, 2025Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user. It is recommended that the Nextcloud Tables app is upgraded to 0.7.6, 0.8.8 or 0.9.5.

Related CWEs

CWE-841

Improper Enforcement of Behavioral Workflow

The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

References (3)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wpp5-4w35-pxq6

Source: security-advisories@github.com

https://github.com/nextcloud/tables/pull/1936

Source: security-advisories@github.com

https://hackerone.com/reports/3249624

Source: security-advisories@github.com

Timeline

No history available yet.