CVE-2025-64011

Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://drive.google.com/file/d/1eD3PN-u1caZYgGH96XHmJ7h_OBXEAHW4/view?usp=sharing	Exploit
https://gist.github.com/tarekramm/586dfe2d113fedfee6d71182570fc090	Exploit Third Party Advisory
https://nextcloud.com	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:nextcloud:nextcloud_server:30.0.0:-:*:*:*:*:*:*

History

14 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Servidor Nextcloud 30.0.0 es vulnerable a una Referencia Directa Insegura a Objeto (IDOR) en el endpoint /core/preview. Cualquier usuario autenticado puede acceder a previsualizaciones de archivos arbitrarios pertenecientes a otros usuarios manipulando el parámetro fileId. Esto permite la divulgación no autorizada de datos sensibles, como archivos de texto o imágenes, sin permisos de compartición previos.

Information

Published : 2025-12-12 17:15

Updated : 2026-10-14 17:10

NVD link : CVE-2025-64011

Mitre link : CVE-2025-64011

CVE.ORG link : CVE-2025-64011

JSON object : View

Products Affected

nextcloud

nextcloud_server

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-64011", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64011", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T19:12:30.962776Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-12T17:15:45.210", "references": [{"url": "https://drive.google.com/file/d/1eD3PN-u1caZYgGH96XHmJ7h_OBXEAHW4/view?usp=sharing", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://gist.github.com/tarekramm/586dfe2d113fedfee6d71182570fc090", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://nextcloud.com", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions."}, {"lang": "es", "value": "Servidor Nextcloud 30.0.0 es vulnerable a una Referencia Directa Insegura a Objeto (IDOR) en el endpoint /core/preview. Cualquier usuario autenticado puede acceder a previsualizaciones de archivos arbitrarios pertenecientes a otros usuarios manipulando el par\u00e1metro fileId. Esto permite la divulgaci\u00f3n no autorizada de datos sensibles, como archivos de texto o im\u00e1genes, sin permisos de compartici\u00f3n previos."}], "lastModified": "2026-10-14T17:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:30.0.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9029EB2-D570-4989-A86B-10E9107FB0E9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}