CVE-2025-64011
BaseFortify
Publication date: 2025-12-12
Last updated on: 2025-12-19
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nextcloud | nextcloud_server | 30.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Insecure Direct Object Reference (IDOR) in Nextcloud Server 30.0.0 at the /core/preview endpoint. It allows any authenticated user to access previews of arbitrary files belonging to other users by manipulating the fileId parameter, bypassing sharing permissions.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive data, such as text files or images, because users can view files they do not have permission to access.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability, monitor authenticated requests to the /core/preview endpoint and check for unusual manipulation of the fileId parameter that accesses files not belonging to the authenticated user. You can use web server logs or proxy tools to identify such requests. For example, using curl to test access: curl -u user:password 'https://your-nextcloud-server/core/preview?fileId=some_id' and verify if files from other users are accessible. Additionally, review access logs for suspicious patterns of fileId parameter usage. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Nextcloud Server from version 30.0.0 to a fixed version, such as 31.0.9.1 or later, where this vulnerability has been addressed. Until the upgrade is applied, restrict access to the /core/preview endpoint to trusted users only and monitor for suspicious activity involving the fileId parameter. [2]