CVE-2024-37314

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-284 CWE-862

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	>= 25.0.1, < 25.0.7; >= 26.0.0, < 26.0.2

References

https://github.com/nextcloud/photos/pull/1749Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43Vendor Advisory
https://hackerone.com/reports/1946298Issue Tracking
https://github.com/nextcloud/photos/pull/1749Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43Vendor Advisory
https://hackerone.com/reports/1946298Issue Tracking

Timeline

Published: Jun 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-373154.3Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a CVE-2024-373164.6Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a CVE-2024-373174.6The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with CVE-2024-373188.8SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability CVE-2024-373198.8SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability CVE-2024-37325.4The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scri CVE-2024-373208.8SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability CVE-2024-373218.8SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability CVE-2024-373228.8SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability CVE-2024-373238.8SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability CVE-2024-373248.8SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability CVE-2024-373258.1Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability