6.4

CVE-2025-59788

Exploit

Development files shipped in files_pdfviewer app

Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.
Mögliche Gegenmaßnahme
Server: * Remove `apps/files_pdfviewer/js/pdfjs/web/viewer.html` manually
Enterprise Server: * Remove `apps/files_pdfviewer/js/pdfjs/web/viewer.html` manually
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Nextcloud Server SwEdition- Version >= 30.0.0 < 30.0.17
Nextcloud ≫ Nextcloud Server SwEdition- Version >= 31.0.0 < 31.0.10
Nextcloud ≫ Nextcloud Server SwEdition- Version >= 32.0.0 < 32.0.1
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 22.0.0 < 22.2.10.33
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 23.0.0 < 23.0.12.29
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 24.0.0 < 24.0.12.28
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 25.0.0 < 25.0.13.23
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 26.0.0 < 26.0.13.20
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 27.0.0 < 27.1.11.20
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 28.0.0 < 28.0.14.11
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 29.0.0 < 29.0.16.8
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 30.0.0 < 30.0.17
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 31.0.0 < 31.0.10
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 32.0.0 < 32.0.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemNextcloud
≫
Produkt Server
Version >= 30.0.0, < 30.0.17
Version >= 31.0.0, < 31.0.10
Version >= 32.0.0, < 32.0.1
SystemNextcloud
≫
Produkt Enterprise Server
Version >= 22.0.0, < 22.2.10.33
Version >= 23.0.0, < 23.0.12.29
Version >= 24.0.0, < 24.0.12.28
Version >= 25.0.0, < 25.0.13.23
Version >= 26.0.0, < 26.0.13.20
Version >= 27.0.0, < 27.1.11.20
Version >= 28.0.0, < 28.0.14.11
Version >= 29.0.0, < 29.0.16.8
Version >= 30.0.0, < 30.0.17
Version >= 31.0.0, < 31.0.10
Version >= 32.0.0, < 32.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.02% 0.06
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cve@mitre.org 6.4 3.1 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE-749 Exposed Dangerous Method or Function

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.