Low
Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission
Type: advisorySources: OSV
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 fix the issue. No known workarounds are available.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-47794
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 17:11 UTC · Revision 1
Source evidence
Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission
core-osv · Original sourcePublished 16 May 2025, 14:35 UTC
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 fix the issue. No known workarounds are available.
osv:CVE-2025-47794
Complete source record
{
"id": "f91038891a5b37fd5867008c0460486b1e0a6837ed59d4250f9a4d82875a579a",
"url": "https://osv.dev/vulnerability/CVE-2025-47794",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission",
"summary": "Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 fix the issue. No known workarounds are available.",
"evidence": "osv:CVE-2025-47794",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2025-47794",
"aliases": [
"CVE-2025-47794",
"GHSA-q568-2933-gcjq"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nextcloud/server",
"type": "GIT",
"events": [
{
"introduced": "36ae775aa7c9af22bf33645a2d8807206ec6c85f"
},
{
"fixed": "dab944fd6a9c1cdc354d056275a438a2e9896455"
},
{
"introduced": "656488893e2175e19fbe273d76a5e16a598000c7"
},
{
"fixed": "5dd6bf7d216ec1a0d53182cd999de41e9065c3d7"
},
{
"introduced": "051e46a7a272300cf7c90b3e330fd1501fd6a996"
},
{
"fixed": "ca86133382c6efb7c0eb82e5b9806a84bad2b9dc"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "29.0.0"
},
{
"fixed": "29.0.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "29.0.0"
},
{
"fixed": "29.0.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "30.0.0"
},
{
"fixed": "30.0.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "30.0.0"
},
{
"fixed": "30.0.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "31.0.0"
},
{
"fixed": "31.0.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "31.0.0"
},
{
"fixed": "31.0.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v29.0.13rc2",
"v30.0.7rc2",
"v31.0.1rc2",
"v29.0.13rc1",
"v30.0.7rc1",
"v31.0.1rc1",
"v31.0.0",
"v29.0.12",
"v30.0.6",
"v29.0.12rc2",
"v30.0.6rc2",
"v29.0.12rc1",
"v30.0.6rc1",
"v29.0.11",
"v30.0.5",
"v29.0.11rc1",
"v30.0.5rc1",
"v29.0.10",
"v30.0.4",
"v30.0.4rc1",
"v30.0.3",
"v30.0.3rc2",
"v29.0.10rc1",
"v30.0.3rc1",
"v30.0.2",
"v29.0.9",
"v29.0.9rc2",
"v30.0.2rc2",
"v29.0.9rc1",
"v30.0.2rc1",
"v30.0.1",
"v29.0.8",
"v30.0.1rc2",
"v29.0.8rc1",
"v30.0.1rc1",
"v29.0.7",
"v30.0.0",
"v29.0.7rc1",
"v29.0.6",
"v29.0.6rc1",
"v29.0.5",
"v29.0.5rc1",
"v29.0.4",
"v29.0.4rc1",
"v29.0.3",
"v29.0.3rc4",
"v29.0.3rc3",
"v29.0.3rc2",
"v29.0.3rc1",
"v29.0.2",
"v29.0.2rc2",
"v29.0.2rc1",
"v29.0.1",
"v29.0.1rc1",
"v29.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47794.json"
}
}
],
"modified": "2026-10-28T02:30:38.080249880Z",
"provider": "osv",
"references": [
"https://hackerone.com/reports/1960647",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47794.json",
"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q568-2933-gcjq",
"https://nvd.nist.gov/vuln/detail/CVE-2025-47794",
"https://github.com/nextcloud/server/pull/51194"
],
"provider_metadata": {
"cwe_ids": [
"CWE-284"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "26.0.0"
},
{
"fixed": "26.0.13.13"
},
{
"introduced": "27.0.0"
},
{
"fixed": "27.1.11.13"
},
{
"introduced": "28.0.0"
},
{
"fixed": "28.0.14.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47794.json"
}
},
"related_cves": [
{
"value": "CVE-2025-47794",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505186,
"published_at": "2025-05-16T14:35:25.28+00:00"
}