CVE-2025-64011CWE-639

CVE-2025-64011

Medium · published December 12, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00275 · 18.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-12-12T22:15Z
Affected products (1)
ProductVersionsFixed in
nextcloud/nextcloud_serverall versions—
References (3)
https://drive.google.com/file/d/1eD3PN-u1caZYgGH96XHmJ7h_OBXEAHW4/view?usp=sharing · [email protected]https://gist.github.com/tarekramm/586dfe2d113fedfee6d71182570fc090 · [email protected]https://nextcloud.com · [email protected]
EPSS history
Timeline
  • 12 DEC 00:00Z
    Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint
    cvelistv5