Read the docs
TI-2025-30258 Aliases CVE-2025-47793

Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file

Priority LOW 30CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-770.

Summary

Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed logged-in users to upload files exceeding the group folder quota. Nextcloud Server versions 30.0.2 and 29.0.9, Nextcloud Enterprise Server versions 30.0.2, 29.0.9, or 28.0.12, and Nextcloud Groupfolders app 18.0.3, 17.0.5, and 16.0.11 fix the issue. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00821 57th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 30.0.2, 29.0.9, 28.0.12 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextcloudsecurity-advisories30.0.0 to before 30.0.2; 29.0.0 to before 29.0.9; 28.0.0 to before 28.0.12; 18.0.0 to before 18.0.3; 17.0.0 to before 17.0.5; 16.0.0 to before 16.0.1130.0.2, 29.0.9, 28.0.12, 18.0.3, 17.0.5, 16.0.11Patch availableCNA
  • security-advisories Vendornextcloud Affected 30.0.0 to before 30.0.2; 29.0.0 to before 29.0.9; 28.0.0 to before 28.0.12; 18.0.0 to before 18.0.3; 17.0.0 to before 17.0.5; 16.0.0 to before 16.0.11 Fixed in 30.0.2, 29.0.9, 28.0.12, 18.0.3, 17.0.5, 16.0.11 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:nextcloud:group_folders:*:*:*:*:*:*:*:*16.0.0 to before 16.0.11; 17.0.0 to before 17.0.5; 18.0.0 to before 18.0.3Vulnerablenextcloud
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*28.0.0 to before 28.0.12Vulnerablenextcloud
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*29.0.0 to before 29.0.9Vulnerablenextcloud
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*29.0.0 to before 29.0.9Vulnerablenextcloud
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*30.0.0 to before 30.0.2Vulnerablenextcloud
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*30.0.0 to before 30.0.2Vulnerablenextcloud
  • cpe:2.3:a:nextcloud:group_folders:*:*:*:*:*:*:*:* Versions 16.0.0 to before 16.0.11; 17.0.0 to before 17.0.5; 18.0.0 to before 18.0.3 Vulnerable ·nextcloud
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* Versions 28.0.0 to before 28.0.12 Vulnerable ·nextcloud
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:* Versions 29.0.0 to before 29.0.9 Vulnerable ·nextcloud
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* Versions 29.0.0 to before 29.0.9 Vulnerable ·nextcloud
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:* Versions 30.0.0 to before 30.0.2 Vulnerable ·nextcloud
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* Versions 30.0.0 to before 30.0.2 Vulnerable ·nextcloud

Remediation

  • Fix · CNA security-advisories (nextcloud) Fixed in 30.0.2, 29.0.9, 28.0.12, 18.0.3, 17.0.5, 16.0.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-47793

References

Patch 2

Advisory 1

Other 1

  • TI-2020-06571 Improper access control in Nextcloud Groupfolders CVSS 3.1HIGH 8.1
  • TI-2025-40956 Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences