CVE-2023-48301

LOW

Nextcloud Server 25.0.0-25.0.12 - Stored Cross-Site Scripting via Circle Name Links

Title source: llm

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clicking the circle name in a search filter. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3 contain a fix for this issue. As a workaround, disable app circles.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wgpw-qqq2-gwv6

Patch x_refsource_misc

https://github.com/nextcloud/circles/pull/1415

Exploit, Third Party Advisory x_refsource_misc

https://hackerone.com/reports/2210038

Scores

CVSS v3 3.5

EPSS 0.0039

EPSS Percentile 59.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

nextcloud/nextcloud_server 25.0.0 - 25.0.13 (2 CPE variants)

Published Nov 21, 2023

Tracked Since Feb 18, 2026