Vulnerability · Published May 16, 2025 · Assigned by GitHub_M

CVE-2025-47791Nextcloud Server's test remote endpoint is not rate limited

Medium 4.3

In plain English

A medium-severity server-side request forgery in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 67.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0.13, 29.0.10, and 30.0.3. No known workarounds are available.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>= 28.0.0, < 28.0.13>= 29.0.0, < 29.0.10>= 30.0.0, < 30.0.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7vq-m7f8-rx37 x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/49558 x_refsource_MISC