CVE-2025-47794: Nextcloud Server Information Disclosure

CVE-2025-47794 Overview

CVE-2025-47794 affects Nextcloud Server and Nextcloud Enterprise Server on multi-user systems. Local attackers sharing a host with a Nextcloud instance can read temporary files created by the Nextcloud process running under a different user account. The same weakness enables symlink attacks against those temporary files. The issue stems from improper access control [CWE-284] on files written to shared temporary directories. Nextcloud addressed the flaw in Server versions 29.0.13, 30.0.7, and 31.0.1, and in Enterprise Server versions 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1.

Critical Impact
Local attackers with a shell account on a shared host can read Nextcloud temporary files or manipulate them via symlinks, leading to information disclosure and potential integrity impact.

Affected Products

Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1
Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4
Nextcloud Enterprise Server prior to 29.0.13, 30.0.7, and 31.0.1

Discovery Timeline

2025-05-16 - CVE-2025-47794 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47794

Vulnerability Analysis

Nextcloud Server writes intermediate data to temporary files during normal operations such as uploads, previews, and encryption workflows. On a multi-user host, those files were created in a shared temporary directory with permissions that allowed other local users to read them. An attacker with a local account on the same system can enumerate and read these files before Nextcloud removes them. The same predictable placement enables a symlink attack, where an attacker pre-creates a symlink at the expected path so Nextcloud writes to or truncates an attacker-chosen file. The result is information disclosure of user data flowing through Nextcloud, plus limited integrity impact against files writable by the Nextcloud service account.

Root Cause

The root cause is improper access control [CWE-284] on temporary files created by the Nextcloud PHP process. Files were placed in a location shared with other local users without restrictive permissions or safe atomic creation semantics that reject existing symlinks. See the Nextcloud Security Advisory GHSA-q568-2933-gcjq and the upstream fix in Pull Request #51194 for the corrected file handling.

Attack Vector

Exploitation requires a local unprivileged account on the same operating system that hosts the Nextcloud Server process. The attacker monitors the shared temporary directory for files created by Nextcloud and reads them, or plants symlinks at predictable paths to redirect Nextcloud writes. No Nextcloud user credentials or web-facing interaction is required. Additional technical detail is available in HackerOne Report #1960647.

Detection Methods for CVE-2025-47794

Indicators of Compromise

Unexpected symbolic links inside the system temporary directory (for example /tmp) that point to files owned by the Nextcloud service account.
Nextcloud log entries showing write failures, permission errors, or truncation of files outside the Nextcloud data directory.
Files owned by the Nextcloud user being accessed or read by non-Nextcloud local user accounts.

Detection Strategies

Audit process and file activity on Nextcloud hosts for local user accounts opening files whose owner is the Nextcloud service user.
Monitor symlink, link, and open syscalls targeting shared temporary directories on Linux hosts running Nextcloud.
Compare the installed Nextcloud version against the fixed releases and flag any deployment below 29.0.13, 30.0.7, or 31.0.1.

Monitoring Recommendations

Enable Linux auditd rules for file creation and symlink operations in /tmp and any TMPDIR used by the PHP-FPM pool serving Nextcloud.
Alert on any local login or interactive shell activity on servers that should only host the Nextcloud application.
Ingest Nextcloud application logs and system audit logs into a centralized platform for correlation across hosts.

How to Mitigate CVE-2025-47794

Immediate Actions Required

Upgrade Nextcloud Server to 29.0.13, 30.0.7, or 31.0.1, or the corresponding Enterprise Server release.
Restrict interactive and shell access on hosts running Nextcloud to trusted administrators only.
Review existing content of the system temporary directory for stale symlinks or files owned by the Nextcloud user.

Patch Information

The vendor fix is delivered in Nextcloud Server 29.0.13, 30.0.7, and 31.0.1, and in Nextcloud Enterprise Server 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1. See the Nextcloud Security Advisory GHSA-q568-2933-gcjq and the GitHub Pull Request #51194 for the code change.

Workarounds

No official workarounds are available from the vendor; upgrading is required.
As a hardening measure only, configure a dedicated per-service TMPDIR for the PHP-FPM pool and restrict its permissions to the Nextcloud user.
Remove untrusted local user accounts from Nextcloud hosts until patches are applied.

bash

# Configuration example: dedicated, restricted temp directory for the Nextcloud PHP-FPM pool
sudo install -d -o www-data -g www-data -m 0700 /var/lib/nextcloud/tmp
# In the PHP-FPM pool configuration (for example /etc/php/8.2/fpm/pool.d/nextcloud.conf):
# env[TMPDIR] = /var/lib/nextcloud/tmp
sudo systemctl restart php8.2-fpm