What’s Vulnerable › Vulnerabilities

CVE-2025-47791: Nextcloud Server's test remote endpoint is not rate limited

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-16 · updated 2026-06-17
• Weakness: CWE-918

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0.13, 29.0.10, and 30.0.3. No known workarounds are available.

Affected products

• Nextcloud Server: from 28.0.0 before 28.0.13; from 29.0.0 before 29.0.10; from 30.0.0 before 30.0.3 — fixed in 28.0.13, 29.0.10, 30.0.3

How to fix

Upgrade to a fixed version: Nextcloud Server 28.0.13, 29.0.10, 30.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7vq-m7f8-rx37
• https://github.com/nextcloud/server/pull/49558

Get alerted when CVE-2025-47791 or the next vulnerability affects your stack