CVE-2025-58051

MediumCVSS 6.5/10Last modified Oct 9, 2026

Description

Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user. It is recommended that the Nextcloud Tables app is upgraded to 0.7.6, 0.8.8 or 0.9.5.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-841

Affected software

VendorProductVersions
nextcloudsecurity-advisories>= 0.7.0, < 0.7.6; >= 0.8.0, < 0.8.8; >= 0.9.0, < 0.9.5

References

Timeline

Published
Oct 16, 2025
Last modified
Oct 9, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-580528.1Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attacCVE-2025-580539.8Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing accountCVE-2025-580545.4Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and renderCVE-2025-580554.3Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “TitCVE-2025-580567.5Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clCVE-2025-580577.5Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers CVE-2025-580585.3xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an CVE-2025-580599.1Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE,CVE-2025-58068.0Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introducCVE-2025-580608.0OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when thCVE-2025-580615.5OpenEBS Local PV RawFile allows dynamic deployment of Stateful Persistent Node-Local Volumes & Filesystems for Kubernetes. Prior to version CVE-2025-580627.3LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp developer. Prior to version 0.1.12, when users on a Windows platform connect to an