Medium severity · published Dec 4, 2025
CVE-2025-59788
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23,…
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Nextcloud · Nextcloud
before 22.2.10.33; 23 before 23.0.12.29; 24 before 24.0.12.28; 25 before 25.0.13.23; 26 before 26.0.13.20; 27 before 27.1.11.20; +5 more · source: vendor
NS
Nextcloud Server · Nextcloud
30.0.0 before 30.0.17; 31.0.0 before 31.0.10; 32.0.0 before 32.0.1; 22.0.0 before 22.2.10.33; 23.0.0 before 23.0.12.29; 24.0.0 before 24.0.12.28; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59788
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59788
Mitigation
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r
Product
https://nextcloud.com
Exploit
https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/
More from Nextcloud
9.8
CVE-2019-5454
SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring to resetup the account
7.5
CVE-2021-43863
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform
7.5
CVE-2021-32727
Nextcloud Android Client is the Android client for Nextcloud
6.8
CVE-2023-28647
Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem
6.8
CVE-2019-5455
Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process