Medium severity5.7NVD Advisory· Published Nov 15, 2024· Updated Jun 17, 2026

CVE-2024-52520

Description

Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nextcloud/Server2 versions
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*+ 1 more
- cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*range: >=28.0.0,<28.0.10
- cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*range: >=27.0.0,<27.1.11.8
Nextcloud/Nextcloud Enterprise Serverllm-fuzzy
Range: 28.0.10, 29.0.7
Nextcloud/security-advisoriescpe-rescue
Range: >= 28.0.0, < 28.0.10

Patches

Vulnerability mechanics

References

github.com/nextcloud/server/commit/873c42b0f1383d5b6f2b7a481e1d9620ed30f44anvdPatch
github.com/nextcloud/server/pull/47627nvdPatch
github.com/nextcloud/security-advisories/security/advisories/GHSA-pxqf-cfxw-mqmjnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.371
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000