CVE record · CVE-2025-59788

Nextcloud: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory…

CVSS 6.4 MediumEPSS 0.0032 · 25th percentile

Published by the CVE Program (CNA: mitre) at 4 Dec 2025, 00:00 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Nextcloud	Nextcloud	affected before 22.2.10.33 custom affected 23 to before 23.0.12.29 custom affected 24 to before 24.0.12.28 custom affected 25 to before 25.0.13.23 custom affected 26 to before 26.0.13.20 custom affected 27 to before 27.1.11.20 custom affected 28 to before 28.0.14.11 custom affected 29 to before 29.0.16.8 custom affected 30 to before 30.0.17 custom affected 31 to before 31.0.10 custom affected 32 to before 32.0.1 custom Other versions: unaffected

Identifiers: CVE-2025-59788
CNA: mitre
Weakness (CWE): CWE-749
Tags: Nextcloud
CWE-749
Published: 4 Dec 2025
Updated: 11 Dec 2025

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
6.4	Medium	3.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	CNA (mitre)

CISA KEV Not listed.
EPSS 0.0032, the 25th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 4 Dec 2025. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.