CVE-2023-25162

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.0.12 are vulnerable to server-side request forgery (SSRF). Attackers can leverage enclosed alphanumeric payloads to bypass IP filters and gain SSRF, which would allow an attacker to read crucial metadata if the server is hosted on the AWS platform. Nextcloud Server 24.0.8 and 23.0.2 and Nextcloud Enterprise Server 24.0.8 and 23.0.12 contain a patch for this issue. No known workarounds are available.

• CWE-918
• CWE-918

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mqrx-grp7-244mVendor Advisory
• https://github.com/nextcloud/server/pull/34160Issue Tracking
• https://hackerone.com/reports/1702864Exploit, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mqrx-grp7-244mVendor Advisory
• https://github.com/nextcloud/server/pull/34160Issue Tracking
• https://hackerone.com/reports/1702864Exploit, Third Party Advisory

Published

Feb 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25157GeoServer is an open source software server written in Java …9.8
• CVE-2023-25158GeoTools is an open source Java library that provides tools …9.8
• CVE-2023-25159Nextcloud Server is the file server software for Nextcloud, …5.3
• CVE-2023-2516Cross-site Scripting (XSS) - Stored in GitHub repository nil…5.4
• CVE-2023-25160Nextcloud Mail is an email app for the Nextcloud home server…5.3
• CVE-2023-25161Nextcloud Server is the file server software for Nextcloud, …5.3
• CVE-2023-25163Argo CD is a declarative, GitOps continuous delivery tool fo…6.5
• CVE-2023-25164Tinacms is a Git-backed headless content management system w…7.5
• CVE-2023-25165Helm is a tool that streamlines installing and managing Kube…4.3
• CVE-2023-25166formula is a math and string formula parser. In versions pri…6.5
• CVE-2023-25167Discourse is an open source discussion platform. In affected…5.7
• CVE-2023-25168Wings is Pterodactyl's server control plane. This vulnerabil…8.2