CVE-2023-25579

MEDIUM

Nextcloud Server < 23.0.12, 20.0.0-20.0.14 - Path Traversal via Folder::getFullPath()

Title source: llm

Description

Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The function is used in the `newFile()` and `newFolder()` items, which may allow to creation of paths outside of ones own space and overwriting data from other users with crafted paths. This issue has been addressed in versions 25.0.2, 24.0.8, and 23.0.12. Users are advised to upgrade. There are no known workarounds for this issue.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-273v-9h7x-p68v

Patch x_refsource_misc

https://github.com/nextcloud/server/pull/35074

Scores

CVSS v3 6.0

EPSS 0.0044

EPSS Percentile 63.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (2)

nextcloud/nextcloud_server < 23.0.12

nextcloud/nextcloud_server 20.0.0 - 20.0.14

Published Feb 22, 2023

Tracked Since Feb 18, 2026