Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0.13, 29.0.10, and 30.0.3. No known workarounds are available.
References
| Link | Resource |
|---|---|
| https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7vq-m7f8-rx37 | Patch Third Party Advisory |
| https://github.com/nextcloud/server/pull/49558 | Patch |
Configurations
Configuration 1 (hide)
|
History
19 Sep 2025, 17:41
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:* cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* |
|
| Summary | (es) Nextcloud Server es un sistema de nube personal autoalojado. En Nextcloud Server anteriores a las versiones 28.0.13, 29.0.10 y 30.0.3, y en Nextcloud Enterprise Server anteriores a las versiones 28.0.13, 29.0.10 y 30.0.3, un endpoint no utilizado para verificar el destinatario de un recurso compartido no estaba protegido correctamente, lo que permitía redirigir las solicitudes a otro servidor. Este punto final se eliminó en Nextcloud Server 28.0.13, 29.0.10 y 30.0.3, y en Nextcloud Enterprise Server 28.0.13, 29.0.10 y 30.0.3. No se conocen soluciones alternativas. | |
| First Time |
Nextcloud nextcloud Server
Nextcloud |
|
| References | () https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7vq-m7f8-rx37 - Patch, Third Party Advisory | |
| References | () https://github.com/nextcloud/server/pull/49558 - Patch |
19 May 2025, 13:35
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
16 May 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-16 15:15
Updated : 2025-09-19 17:41
NVD link : CVE-2025-47791
Mitre link : CVE-2025-47791
CVE.ORG link : CVE-2025-47791
JSON object : View
Products Affected
nextcloud
- nextcloud_server
CWE
CWE-918
Server-Side Request Forgery (SSRF)