CVE-2025-47791 Overview
CVE-2025-47791 is a Server-Side Request Forgery (SSRF) vulnerability in Nextcloud Server and Nextcloud Enterprise Server. An unused endpoint intended to verify a share recipient lacked proper access controls. Unauthenticated attackers can abuse the endpoint to proxy HTTP requests to arbitrary destinations through the Nextcloud instance. The flaw is tracked under CWE-918 and affects versions prior to 28.0.13, 29.0.10, and 30.0.3.
Critical Impact
Attackers can relay HTTP requests through a vulnerable Nextcloud Server to reach internal services or third-party endpoints, enabling reconnaissance of internal networks and abuse of the server's trust relationships.
Affected Products
- Nextcloud Server versions prior to 28.0.13
- Nextcloud Server versions prior to 29.0.10 and 30.0.3
- Nextcloud Enterprise Server versions prior to 28.0.13, 29.0.10, and 30.0.3
Discovery Timeline
- 2025-05-16 - CVE-2025-47791 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47791
Vulnerability Analysis
The vulnerability resides in a legacy endpoint originally designed to verify share recipients on remote Nextcloud instances. The endpoint was left in the codebase but was no longer used by current sharing workflows. Authentication and destination validation were not enforced on this route. As a result, attackers can send crafted requests to the endpoint and have the Nextcloud Server issue outbound HTTP requests on their behalf.
Because the server acts as the request originator, the outbound calls carry the trust and network position of the Nextcloud host. This enables interaction with internal services that are otherwise unreachable from the public internet, including metadata services, internal APIs, and administrative interfaces bound to loopback addresses.
Root Cause
The root cause is missing authorization enforcement combined with insufficient URL validation on a dormant share-recipient verification endpoint. Because the endpoint was no longer part of the sharing flow, its access controls were never hardened, and no allowlist restricted the target hosts it could contact. Nextcloud resolved the issue by removing the endpoint entirely rather than patching input validation.
Attack Vector
Exploitation requires only network reachability to the Nextcloud web interface. No credentials or user interaction are needed. An attacker sends an HTTP request to the vulnerable endpoint with a chosen target URL. The Nextcloud Server issues an outbound request to that URL and may return response data or side effects to the attacker. Typical SSRF abuse patterns apply, including cloud metadata service access, internal port scanning, and pivoting to unauthenticated internal services.
See the Nextcloud GitHub Security Advisory GHSA-c7vq-m7f8-rx37 and the remediation pull request for technical details on the removed endpoint.
Detection Methods for CVE-2025-47791
Indicators of Compromise
- Unexpected outbound HTTP connections from the Nextcloud Server process to internal RFC1918 ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
- Access log entries hitting the deprecated share recipient verification endpoint from unauthenticated or unusual source IP addresses.
- Spikes in requests to sharing-related routes with abnormal URL parameters referencing hostnames outside the federation topology.
Detection Strategies
- Review Nextcloud web server access logs for the removed endpoint path and correlate with the source IP, user agent, and request frequency.
- Instrument the Nextcloud host with egress monitoring to alert on outbound connections initiated by the PHP-FPM or web server process to unexpected destinations.
- Compare application version strings against fixed releases 28.0.13, 29.0.10, and 30.0.3 to identify unpatched hosts.
Monitoring Recommendations
- Forward Nextcloud application logs and reverse proxy logs to a central analytics platform for continuous review.
- Enable network flow monitoring on the segment hosting Nextcloud to identify SSRF-style pivoting to internal assets.
- Alert on any HTTP request from the Nextcloud host targeting cloud provider metadata IP addresses.
How to Mitigate CVE-2025-47791
Immediate Actions Required
- Upgrade Nextcloud Server or Nextcloud Enterprise Server to version 28.0.13, 29.0.10, or 30.0.3 or later.
- Audit access logs for prior requests to the removed share recipient verification endpoint and investigate any matches.
- Restrict outbound network access from the Nextcloud host to only the destinations required for federation, updates, and app store connectivity.
Patch Information
Nextcloud removed the vulnerable endpoint in Nextcloud Server and Nextcloud Enterprise Server versions 28.0.13, 29.0.10, and 30.0.3. The change is documented in the server pull request #49558. Administrators should apply the update through the standard Nextcloud upgrade process and verify the reported version after restart.
Workarounds
- No official workarounds are available according to the vendor advisory. Upgrading is required.
- As a compensating control, place the Nextcloud host behind an egress proxy that blocks connections to internal ranges and cloud metadata endpoints until the patch is applied.
# Verify installed Nextcloud version after upgrade
sudo -u www-data php /var/www/nextcloud/occ status
# Example egress restriction using iptables to block metadata service
iptables -A OUTPUT -d 169.254.169.254 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
