Description
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 fix the issue. No known workarounds are available.
CVSS Metrics
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
- Attack Vector
- network
- Complexity
- high
- Privileges
- low
- User Action
- required
- Scope
- unchanged
- Confidentiality
- none
- Integrity
- low
- Availability
- none
- Weaknesses
- CWE-284NVD-CWE-noinfo
Metadata
- Primary Vendor
- NEXTCLOUD
- Published
- 5/16/2025
- Last Modified
- 9/30/2025
- Source
- NIST NVD
- Note: Verify all details with official vendor sources before applying patches.
Affected Products
nextcloud : nextcloud_servernextcloud : nextcloud_servernextcloud : nextcloud_servernextcloud : nextcloud_servernextcloud : nextcloud_servernextcloud : nextcloud_servernextcloud : nextcloud_servernextcloud : nextcloud_servernextcloud : nextcloud_server
AI-Powered Remediation
Generate remediation guidance or a C-suite brief for this vulnerability.