Skip to content
CVE PROGRAM SOURCE RECORD5.0 Medium

CVE-2025-47792

Nextcloud Desktop 3rdparty applications can create share links via socket API

Description

Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nextcloud security-advisories

  • < 3.15affected

References