CVE-2025-47792
Nextcloud Desktop 3rdparty applications can create share links via socket API
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Nextcloud Desktop 3rdparty applications can create share links via socket API
Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available.
Reserved 2025-05-09 | Published 2025-05-16 | Updated 2025-05-16 | Assigner GitHub_MCWE-284: Improper Access Control
github.com/...sories/security/advisories/GHSA-qm2f-959g-7p65
github.com/nextcloud/desktop/pull/7517
Support options
