PT-2025-21658 · Nextcloud+1 · Nextcloud Desktop+1

Nickvergessen · Published 2025-05-16 · Updated 2026-04-29 · CVE-2025-47792

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop versions prior to 3.15

Description: The issue affects Nextcloud Desktop, allowing 3rd party applications to create link shares for almost all data via the socket API. These shares can then be sent to an external service.

Recommendations: For versions prior to 3.15, update to version 3.15 to resolve the issue. As a temporary workaround, consider restricting access to the socket API until the update is applied.

Exploit

Fix

Missing Authorization

Improper Access Control

Weakness Enumeration

CWE-862

CWE-284

Related Identifiers

BDU:2026-02085

CVE-2025-47792

GHSA-QM2F-959G-7P65

Affected Products

Debian

Nextcloud Desktop

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47792.json · Exploit
• https://github.com/nextcloud/desktop/pull/7517 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-47792 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-47792 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-47792 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-47792 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-47792 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-47792 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47792 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02085 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qm2f-959g-7p65 · Note
• https://t.me/cvenotify/122908 · Telegram Post
• https://twitter.com/saaaadhjj/status/2049517296029249967 · Twitter Post
• https://hackerone.com/reports/1995856 · Note
• https://t.me/cvenotify/122584 · Telegram Post