VYPR
← All advisories
Medium severity6.4NVD Advisory· Published Dec 4, 2025· Updated Oct 18, 2026

CVE-2025-59788

CVE-2025-59788

Description

Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Nextcloud/Nextcloudcpe-rescue2 versions
    0+ 1 more
    • (no CPE)range: 0
    • (no CPE)range: <22.2.10.33, <23.0.12.29, <24.0.12.28, <25.0.13.23, <26.0.13.20, <27.1.11.20, <28.0.14.11, <29.0.16.8, <30.0.17, <31.0.10, <32.0.10
  • Nextcloud/Server2 versions
    cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*+ 1 more
    • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*range: >=30.0.0,<30.0.17
    • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*range: >=22.0.0,<22.2.10.33

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.