CVE-2025-58051: Nextcloud Tables Information Disclosure

CVE-2025-58051 Overview

CVE-2025-58051 is an information disclosure vulnerability in the Nextcloud Tables app. The flaw allows authenticated users to read server-side files during the table import process. When a user submits an import request, the application accepts server file paths and passes them to the PhpSpreadsheet library. If PhpSpreadsheet supports the file format, its contents are parsed and returned to the requesting user. The issue affects Nextcloud Tables versions prior to 0.7.6, 0.8.8, and 0.9.5. The vulnerability is classified as an improper enforcement of behavioral workflow weakness [CWE-841].

Critical Impact
Authenticated users can leak the contents of arbitrary server-side files that are parseable by PhpSpreadsheet, exposing sensitive data outside their access scope.

Affected Products

Nextcloud Tables app versions prior to 0.7.6
Nextcloud Tables app versions 0.8.0 through 0.8.7
Nextcloud Tables app versions 0.9.0 through 0.9.4

Discovery Timeline

2025-10-16 - CVE-2025-58051 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58051

Vulnerability Analysis

The Nextcloud Tables app provides functionality for users to create and manage custom tables with individual columns. The import feature accepts a file reference and delegates parsing to the PhpSpreadsheet library.

The vulnerable code path does not restrict the file reference to user-accessible resources. An authenticated user can supply a path pointing to files residing on the server. If the target file matches a format that PhpSpreadsheet can parse, the library reads its contents and the import routine returns the parsed data to the requester.

This behavior turns the import feature into a file read primitive. Attackers can enumerate files supported by PhpSpreadsheet parsers, including .xlsx, .xls, .ods, .csv, and .html variants, and extract their contents.

Root Cause

The root cause is improper enforcement of behavioral workflow. The import handler treats the supplied file path as trusted input rather than validating that the path resolves to a resource the requesting user is authorized to read. The application relies on PhpSpreadsheet to open the file directly, bypassing Nextcloud's storage and permission layers.

Attack Vector

Exploitation requires low-privileged authenticated access to a Nextcloud instance running the Tables app. The attacker initiates an import operation and specifies a file path pointing to a server-side resource. The application responds with the parsed content, disclosing information the user should not have access to. No user interaction from another party is required. Refer to the GitHub Security Advisory GHSA-wpp5-4w35-pxq6 and the HackerOne Report #3249624 for additional technical context.

Detection Methods for CVE-2025-58051

Indicators of Compromise

Table import requests referencing file paths that fall outside the requesting user's normal storage scope.
Import operations targeting file extensions supported by PhpSpreadsheet such as .xlsx, .xls, .ods, .csv, or .html originating from unexpected locations.
Repeated import failures followed by successful imports, indicating file path enumeration.

Detection Strategies

Review Nextcloud audit logs for import events initiated against the Tables app and correlate source file paths with the requesting account's permitted storage.
Alert on import requests where the referenced file path is absolute or contains traversal sequences.
Compare Tables app import telemetry with expected user behavior baselines to surface anomalous file access patterns.

Monitoring Recommendations

Enable verbose logging for the Tables app import endpoint and forward logs to a centralized analytics platform.
Track the version of the installed Nextcloud Tables app across all deployments and flag versions below 0.7.6, 0.8.8, and 0.9.5.
Monitor outbound API responses from the import handler for payload sizes inconsistent with legitimate spreadsheet imports.

How to Mitigate CVE-2025-58051

Immediate Actions Required

Upgrade the Nextcloud Tables app to version 0.7.6, 0.8.8, or 0.9.5 depending on the deployed branch.
Audit historical import events since the Tables app was installed to identify suspicious file references.
Rotate credentials or secrets that may have been stored in files parseable by PhpSpreadsheet on the Nextcloud server.

Patch Information

The Nextcloud project addressed CVE-2025-58051 in Tables app releases 0.7.6, 0.8.8, and 0.9.5. The fix is tracked in GitHub Pull Request #1936. Administrators should apply the corresponding update through the Nextcloud app management interface or by pulling the patched release from the app store.

Workarounds

Restrict access to the Tables app to trusted users until the patch is applied.
Disable the Tables app in environments where an immediate upgrade is not feasible.
Apply file system permissions that prevent the Nextcloud web server user from reading sensitive files outside the data directory.

bash

# Disable the Nextcloud Tables app until patched
sudo -u www-data php /var/www/nextcloud/occ app:disable tables

# Upgrade the Tables app to a patched release
sudo -u www-data php /var/www/nextcloud/occ app:update tables

# Verify the installed version
sudo -u www-data php /var/www/nextcloud/occ app:list | grep tables