Nextcloud Server
Approved changes feed: RSS · Atom
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*
part: a version: * update: *
| Vendor | Nextcloud (e5ae4298-6932-564f-a40d-08cebea039a5) |
|---|---|
| Product | Nextcloud Server (1b3f7567-9687-57ec-81e9-325dd62e7470) |
| Edition | * |
| Language | * |
| Software edition | - |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/nextcloud/server |
purl2cpe | 2026-06-01 10:17:58.950498 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-66552 |
vulnerable | 2026-06-08 07:41:19.165590 |
Nextcloud Server admin_audit does not log all actions on files in groupfolders
MEDIUM (4.3)
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.
Published: 2025-12-05T16:36:39.749Z
Updated: 2025-12-05T18:25:06.200Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66547 |
vulnerable | 2026-06-08 07:41:19.159875 |
Nextcloud Server users can modify tags on files that do not belong to them
MEDIUM (4.3)
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.
Published: 2025-12-05T16:32:17.359Z
Updated: 2025-12-05T18:20:43.503Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66512 |
vulnerable | 2026-06-08 07:41:19.096022 |
Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud
MEDIUM (5.4)
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page.
Published: 2025-12-05T16:22:50.206Z
Updated: 2025-12-05T20:05:05.069Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66510 |
vulnerable | 2026-06-08 07:41:19.093196 |
Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list
MEDIUM (4.5)
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.
Published: 2025-12-05T16:18:53.699Z
Updated: 2025-12-05T20:02:53.678Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59788 |
vulnerable | 2026-06-08 07:35:23.105875 |
Details available
MEDIUM (6.4)
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.
Published: 2025-12-04T00:00:00.000Z
Updated: 2025-12-11T15:04:25.726Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-47794 |
vulnerable | 2026-06-08 07:27:14.884578 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-47793 |
vulnerable | 2026-06-08 07:27:14.883896 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-47791 |
vulnerable | 2026-06-08 07:27:14.878877 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-47790 |
vulnerable | 2026-06-08 07:27:14.878396 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52525 |
vulnerable | 2026-06-08 06:52:15.347261 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52523 |
vulnerable | 2026-06-08 06:52:15.345138 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52521 |
vulnerable | 2026-06-08 06:52:15.341297 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52520 |
vulnerable | 2026-06-08 06:52:15.340948 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52519 |
vulnerable | 2026-06-08 06:52:15.340466 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52518 |
vulnerable | 2026-06-08 06:52:15.339950 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52515 |
vulnerable | 2026-06-08 06:52:15.336803 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52514 |
vulnerable | 2026-06-08 06:52:15.336380 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52513 |
vulnerable | 2026-06-08 06:52:15.335684 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37887 |
vulnerable | 2026-06-08 06:39:48.186894 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37884 |
vulnerable | 2026-06-08 06:39:48.183764 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37882 |
vulnerable | 2026-06-08 06:39:48.176848 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37315 |
vulnerable | 2026-06-08 06:39:47.131550 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37313 |
vulnerable | 2026-06-08 06:39:47.129243 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49792 |
vulnerable | 2026-06-08 06:16:10.489469 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49791 |
vulnerable | 2026-06-08 06:16:10.488674 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48306 |
vulnerable | 2026-06-08 06:14:26.844111 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48305 |
vulnerable | 2026-06-08 06:14:26.843560 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48304 |
vulnerable | 2026-06-08 06:14:26.842896 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48303 |
vulnerable | 2026-06-08 06:14:26.842479 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48302 |
vulnerable | 2026-06-08 06:14:26.841897 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48301 |
vulnerable | 2026-06-08 06:14:26.841265 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48239 |
vulnerable | 2026-06-08 06:14:26.369461 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45151 |
vulnerable | 2026-06-08 06:12:42.063990 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45148 |
vulnerable | 2026-06-08 06:12:42.058382 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39963 |
vulnerable | 2026-06-08 06:09:38.199907 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39962 |
vulnerable | 2026-06-08 06:09:38.198825 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39961 |
vulnerable | 2026-06-08 06:09:38.193040 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39960 |
vulnerable | 2026-06-08 06:09:38.192610 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39959 |
vulnerable | 2026-06-08 06:09:38.191932 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39958 |
vulnerable | 2026-06-08 06:09:38.191174 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39952 |
vulnerable | 2026-06-08 06:09:38.163465 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-35928 |
vulnerable | 2026-06-08 06:06:28.167602 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-35927 |
vulnerable | 2026-06-08 06:06:28.166910 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-35172 |
vulnerable | 2026-06-08 06:06:26.692297 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-35171 |
vulnerable | 2026-06-08 06:06:26.690830 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-32320 |
vulnerable | 2026-06-08 06:04:45.493515 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-32318 |
vulnerable | 2026-06-08 06:04:45.484997 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-30539 |
vulnerable | 2026-06-08 06:04:39.750914 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28847 |
vulnerable | 2026-06-08 06:02:36.522175 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28835 |
vulnerable | 2026-06-08 06:02:36.491391 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28834 |
vulnerable | 2026-06-08 06:02:36.490870 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28833 |
vulnerable | 2026-06-08 06:02:36.490090 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28643 |
vulnerable | 2026-06-08 06:01:14.623928 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-26482 |
vulnerable | 2026-06-08 05:57:39.787127 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25818 |
vulnerable | 2026-06-08 05:56:10.667242 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.