Description
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.
Problem types
CWE-749 Exposed Dangerous Method or Function
Product status
Any version before 22.2.10.33
23 (custom) before 23.0.12.29
24 (custom) before 24.0.12.28
25 (custom) before 25.0.13.23
26 (custom) before 26.0.13.20
27 (custom) before 27.1.11.20
28 (custom) before 28.0.14.11
29 (custom) before 29.0.16.8
30 (custom) before 30.0.17
31 (custom) before 31.0.10
32 (custom) before 32.0.1
References
www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/
github.com/...sories/security/advisories/GHSA-24wp-p865-7j4r
