CVE-2025-47791: Nextcloud Server's test remote endpoint is not rate limited
Description
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0.13, 29.0.10, and 30.0.3. No known workarounds are available.
Classification
CVE ID: CVE-2025-47791
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.3
CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Problem Types
CWE-918: Server-Side Request Forgery (SSRF)Affected Products
Vendor: nextcloud
Product: security-advisories
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.03% (probability of being exploited)
EPSS Percentile: 7.3% (scored less or equal to compared to others)
EPSS Date: 2025-06-14 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: partial
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2025-47791https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7vq-m7f8-rx37
https://github.com/nextcloud/server/pull/49558