CVE-2025-59788VulnerabilityPublished 4 Dec 2025

CVE-2025-59788: n/a

Source CVE Database V5

Mentioned vulnerabilities

CVE-2024-4367

Not known to be exploited.

Data as of 26 Oct 2026, 06:26 UTC

Severity

High

Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 0.3% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate CVE-2025-59788, European organizations should prioritize the following actions: 1) Apply security updates and patches for Nextcloud immediately once they are released for the affected versions listed. 2) Restrict or disable access to example directories such as files_pdfviewer on production systems to reduce exposure. 3) Implement Content Security Policy (CSP) headers to limit the execution of unauthorized scripts within the browser context. 4) Educate users about the risks of opening PDF files from untrusted sources, emphasizing caution with files received via email or external channels. 5) Monitor web server logs and Nextcloud access logs for unusual activity related to the PDF viewer or attempts to access the example directory. 6) Employ web application firewalls (WAFs) with rules designed to detect and block XSS payloads targeting the PDF viewer. 7) Conduct regular security assessments and penetration testing focused on web application components, including third-party plugins and example directories. 8) Review and harden Nextcloud configuration to disable unnecessary features or example content that may introduce vulnerabilities. These measures, combined with prompt patching, will significantly reduce the risk posed by this vulnerability.

Description

CVE-2025-59788 is a cross-site scripting (XSS) vulnerability affecting the PDF viewer component of Nextcloud in multiple versions prior to specified patch releases. The vulnerability exists in a reachable example directory (files_pdfviewer) and allows an attacker to execute arbitrary JavaScript in the context of a user's browser by delivering a crafted PDF file to viewer.html. This can lead to session hijacking, credential theft, or other malicious actions within the user's session. Although no known exploits are currently reported in the wild, the vulnerability is related to a previous XSS issue (CVE-2024-4367), indicating a recurring weakness in the PDF viewer. European organizations using affected Nextcloud versions are at risk, especially those relying heavily on Nextcloud for document collaboration and storage. Mitigation requires updating to the fixed versions as soon as they become available and restricting access to example directories. Countries with high Nextcloud adoption and significant cloud collaboration usage, such as Germany, France, and the Netherlands, are most likely to be impacted. Given the ease of exploitation and potential impact on confidentiality and integrity without requiring authentication, this vulnerability is assessed as high severity.

Impact

For European organizations, the impact of CVE-2025-59788 can be substantial, especially for those using Nextcloud as a core platform for file sharing and collaboration. Successful exploitation could lead to unauthorized access to sensitive documents, session hijacking, and potential lateral movement within corporate networks. This could result in data breaches, loss of intellectual property, and reputational damage. Given the nature of XSS, attackers might also use this vulnerability as a foothold to deploy further attacks such as phishing campaigns or malware distribution within trusted environments. Organizations in regulated industries (e.g., finance, healthcare, government) face additional compliance risks due to potential exposure of personal or confidential data. The vulnerability's exploitation does not require authentication but does require user interaction, which means phishing or social engineering could be effective attack vectors. The impact on availability is limited but could be exacerbated if attackers leverage the vulnerability to disrupt user sessions or inject malicious scripts that degrade service performance. Overall, the threat undermines user trust in Nextcloud deployments and could lead to significant operational and security challenges.

Summary

CVE-2025-59788 is a cross-site scripting (XSS) vulnerability identified in the Nextcloud PDF viewer component, specifically within a reachable example directory named files_pdfviewer. This vulnerability affects multiple Nextcloud versions prior to 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1. The flaw allows an attacker to craft a malicious PDF file that, when opened via the viewer.html interface, executes arbitrary JavaScript code in the context of the victim's browser session. This can lead to theft of session cookies, unauthorized actions on behalf of the user, or further exploitation such as phishing or malware delivery. The vulnerability stems from insufficient input sanitization or improper handling of PDF content in the example directory, which is publicly accessible. Although no active exploits have been reported, the similarity to the earlier CVE-2024-4367 suggests a persistent issue in the PDF viewer's security posture. The vulnerability does not require user authentication but does require user interaction to open the crafted PDF, making social engineering a likely attack vector. The absence of a CVSS score necessitates an assessment based on impact and exploitability factors. The vulnerability compromises confidentiality and integrity primarily, with a moderate impact on availability. The scope is limited to users accessing the vulnerable PDF viewer component, but given Nextcloud's widespread use in enterprise and public sectors, the potential reach is significant. The patch availability is implied but not explicitly linked, so timely updates are critical. Overall, this vulnerability represents a significant risk to organizations relying on Nextcloud for document management and collaboration.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 4 Dec 2025, 19:10 UTC

Technical details

References

Community reviews

Related threats