Description
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.
Scores
CVSS v3
6.4
EPSS
0.0003
EPSS Percentile
9.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-749
CWE-79
Status
published
Products (13)
Nextcloud/Nextcloud
< 22.2.10.33
Nextcloud/Nextcloud
23 - 23.0.12.29
Nextcloud/Nextcloud
24 - 24.0.12.28
Nextcloud/Nextcloud
25 - 25.0.13.23
Nextcloud/Nextcloud
26 - 26.0.13.20
Nextcloud/Nextcloud
27 - 27.1.11.20
Nextcloud/Nextcloud
28 - 28.0.14.11
Nextcloud/Nextcloud
29 - 29.0.16.8
Nextcloud/Nextcloud
30 - 30.0.17
Nextcloud/Nextcloud
31 - 31.0.10
... and 3 more
Published
Dec 04, 2025
Tracked Since
Feb 18, 2026