CVE-2025-58051CWE-841

CVE-2025-58051

Medium · published October 16, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
44.1
In the wild
Unconfirmed
What it is

Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user. It is recommended that the Nextcloud Tables app is upgraded to 0.7.6, 0.8.8 or 0.9.5.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00532 · 44.1th percentile
Weakness
CWE-841 · Improper Enforcement of Behavioral Workflow
Published
2025-10-16T21:15Z
References (3)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wpp5-4w35-pxq6 · [email protected]https://github.com/nextcloud/tables/pull/1936 · [email protected]https://hackerone.com/reports/3249624 · [email protected]
EPSS history
Timeline
  • 16 OCT 16:48Z
    Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table
    cvelistv5