Medium severity · published Nov 15, 2024
CVE-2024-52515
Nextcloud Server has incomplete sanitization of SVG files allows to embed other images into previews
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended that the Nextcloud Server is upgraded to 27.1.10, 28.0.6 or 29.0.1 and Nextcloud Enterprise Server is upgraded to 24.0.12.15, 25.0.13.10, 26.0.13.4, 27.1.10, 28.0.6 or 29.0.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
security-advisories · nextcloud
>= 29.0.0, < 29.0.1; >= 28.0.0, < 28.0.6; >= 27.0.0, < 27.1.10 · source: vendor
NS
Nextcloud Server · Nextcloud
24.0.0 before 24.0.12.15; 25.0.0 before 25.0.13.10; 26.0.0 before 26.0.13.4; 27.0.0 before 27.1.10; 27.0.0 before 27.1.10; 28.0.0 before 28.0.6; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52515
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52515
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5m5g-hw8c-2236
Patch
https://github.com/nextcloud/server/commit/7e1c30f82a63fbea8c269e0eec38291377f32604
Issue Tracking
https://github.com/nextcloud/server/pull/45340
Issue Tracking
https://hackerone.com/reports/2484499
More from security-advisories
9.8
CVE-2024-22212
Nextcloud global site selector authentication bypass
9.8
CVE-2023-49792
Bruteforce protection can be bypassed with misconfigured proxy
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.8
CVE-2026-45284
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
8.2
CVE-2026-45545
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution