CVE-2025-64011
Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions.
- Affected products
- Nextcloud Server, Red Os
- Nextcloud Nextcloud Server
- = 30.0.0
- Fix
- Available
- CVSS 3.1
- 4.3 MEDIUM
- EPSS
- 0.2% (16th percentile)
- Weakness
- CWE-639
- NVD status
- Analyzed
- Published
- 2025-12-12
CVE-2025-64011 at NVD
No indexed exploits for CVE-2025-64011 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2025-64011 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.