CVE-2025-47794CWE-284

Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission

Low · published May 16, 2025

CVSS v3.1
2.6
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 fix the issue. No known workarounds are available.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00495 · 41.6th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-05-16T14:35Z
EPSS history
Timeline
  • 16 MAY 14:35Z
    Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission
    cvelistv5