CVE-2023-25817

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the Nextcloud Server is upgraded to 24.0.9. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-281CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-258187.1Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of CVE-2023-258195.3Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any siteCVE-2023-25826.1A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applicatioCVE-2023-258207.8Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enteCVE-2023-258217.5Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contaCVE-2023-258226.5ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the `com.epam.reportportal:service-api` module, corresponCVE-2023-258239.8Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contCVE-2023-258247.5Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read oCVE-2023-258256.1ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. VersioCVE-2023-258269.8Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multipleCVE-2023-258276.1Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possibCVE-2023-258287.2Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create