Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 fix the issue. No known workarounds are available.
References
| Link | Resource |
|---|---|
| https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q568-2933-gcjq | Vendor Advisory |
| https://github.com/nextcloud/server/pull/51194 | Issue Tracking |
| https://hackerone.com/reports/1960647 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
30 Sep 2025, 19:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q568-2933-gcjq - Vendor Advisory | |
| References | () https://github.com/nextcloud/server/pull/51194 - Issue Tracking | |
| References | () https://hackerone.com/reports/1960647 - Permissions Required | |
| CPE | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:* |
|
| First Time |
Nextcloud nextcloud Server
Nextcloud |
|
| CWE | NVD-CWE-noinfo |
19 May 2025, 13:35
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
16 May 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-16 15:15
Updated : 2025-09-30 19:37
NVD link : CVE-2025-47794
Mitre link : CVE-2025-47794
CVE.ORG link : CVE-2025-47794
JSON object : View
Products Affected
nextcloud
- nextcloud_server
CWE