CVE-2025-59788

State: Published
Severity: 6.4 Medium
Published: Dec 4, 2025
Updated: Dec 11, 2025
Reserved: Sep 19, 2025

Description

Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	mitre

Weaknesses

CWE-749 Exposed Dangerous Method or Function

Affected Products

Product	Versions
NextcloudNextcloud	before 22.2.10.33Affected 23 to before 23.0.12.29Affected 24 to before 24.0.12.28Affected 25 to before 25.0.13.23Affected 26 to before 26.0.13.20Affected 27 to before 27.1.11.20Affected 28 to before 28.0.14.11Affected 29 to before 29.0.16.8Affected 30 to before 30.0.17Affected 31 to before 31.0.10Affected 32 to before 32.0.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.