CVE-2023-48239

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Enterprise Server, a malicious user could update any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud Server 25.0.13, 26.0.8, and 27.1.3 and Nextcloud Enterprise Server is upgraded to 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 contain a patch for this issue. As a workaround, disable app files_external. This workaround also makes the external storage inaccessible but retains the configurations until a patched version has been deployed.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Nov 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-48248.8The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a loggCVE-2023-482408.8XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difCVE-2023-482417.5XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the SolrCVE-2023-482426.5The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the apCVE-2023-482438.8The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS userCVE-2023-482446.1The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted UCVE-2023-482459.8The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) CVE-2023-482466.5The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS usCVE-2023-482477.5The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) viCVE-2023-482485.4The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script CVE-2023-482496.5The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the applCVE-2023-482509.8The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded ac
CVE-2023-48239: High severity, CVSS 7.1 | Vulnix