Description (CNA)
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Nextcloud / Nextcloud | affected 0 before 22.2.10.33; affected 23 before 23.0.12.29; affected 24 before 24.0.12.28; affected 25 before 25.0.13.23; affected 26 before 26.0.13.20; affected 27 before 27.1.11.20; affected 28 before 28.0.14.11; affected 29 before 29.0.16.8; affected 30 before 30.0.17; affected 31 before 31.0.10; affected 32 before 32.0.1 |
CWE
CWE-749
References
- https://nextcloud.com
- https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r
ADP enrichment
No English description supplied.
No references supplied.