Nextcloud Server up to 30.0.1 Group Folder allocation of resources

Summaryinfo

A vulnerability identified as problematic has been detected in Nextcloud Server up to 30.0.1. This affects an unknown part of the component Group Folder Handler. The manipulation leads to allocation of resources. This vulnerability is documented as CVE-2025-47793. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Nextcloud Server up to 30.0.1. It has been rated as problematic. This issue affects some unknown functionality of the component Group Folder Handler. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is integrity. The summary by CVE is:

Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed logged-in users to upload files exceeding the group folder quota. Nextcloud Server versions 30.0.2 and 29.0.9, Nextcloud Enterprise Server versions 30.0.2, 29.0.9, or 28.0.12, and Nextcloud Groupfolders app 18.0.3, 17.0.5, and 16.0.11 fix the issue. No known workarounds are available.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-47793 since 05/09/2025. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 16.0.11, 17.0.5, 18.0.3, 28.0.12, 29.0.9 or 30.0.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Nextcloud

Name

• Server

Version

• 16.0.0
• 16.0.1
• 16.0.2
• 16.0.3
• 16.0.4
• 16.0.5
• 16.0.6
• 16.0.7
• 16.0.8
• 16.0.9
• 16.0.10
• 17.0.0
• 17.0.1
• 17.0.2
• 17.0.3
• 17.0.4
• 18.0.0
• 18.0.1
• 18.0.2
• 28.0.0
• 28.0.1
• 28.0.2
• 28.0.3
• 28.0.4
• 28.0.5
• 28.0.6
• 28.0.7
• 28.0.8
• 28.0.9
• 28.0.10
• 28.0.11
• 29.0.0
• 29.0.1
• 29.0.2
• 29.0.3
• 29.0.4
• 29.0.5
• 29.0.6
• 29.0.7
• 29.0.8
• 30.0.0
• 30.0.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion