CVE-2025-47793

CWE-770 — Allocation without Limits2 documents2 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 48.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Nextcloud Group FoldersNextcloud Nextcloud ServerNextcloud Security-advisories
Timeline
PublishedMay 16

Description

Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed logged-in users to upload files exceeding the group folder quota. Nextcloud Server versions 30.0.2 a…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶NVDnextcloud/group_folders16.0.0 — 16.0.11+2
▶NVDnextcloud/nextcloud_server28.0.0 — 28.0.12+2
▶CVEListV5nextcloud/security-advisories6 versions+5

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
CVEList
Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file↗2025-05-16
▶
CVE-2025-47793 (MEDIUM CVSS 6.5) | Nextcloud Server is a self hosted p | cvebase.io