Nextcloud Tables CVE-2025-58051

Exploitation requires an authenticated Nextcloud user (PR:L) who has access to the Tables app's import feature; the attacker invokes the import/previewImport flow (ImportService.php) and supplies a server-side file path instead of a legitimately uploaded file. The disclosed content is limited to files whose format is parseable by the PhpSpreadsheet library used by the app (e.g. spreadsheet/CSV/ODS/XML formats it supports), which constrains which server files can be leaked. Limiting factors: the Tables app must be installed and the attacker must hold a valid account with import permissions on a reachable instance running a version prior to 0.7.6/0.8.8/0.9.5; no code execution or write impact is possible.

This is a moderate-risk authenticated information disclosure flaw, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5 Medium) indicates a network-reachable attack requiring low privileges (an authenticated Nextcloud user with import capability), low complexity, no user interaction, and high confidentiality impact with no integrity or availability impact - consistent with arbitrary server-side file read. Exploitation signals are modest: EPSS is 0.53% (43rd percentile), indicating low predicted exploitation probability, and there is no CISA KEV listing. No public exploit was identified at time of analysis; a HackerOne report (3249624) exists but is a private coordinated-disclosure channel, not public POC code, so POC availability cannot be confirmed. No SSVC decision data was provided in the input. The signals are internally consistent - a low EPSS and absent KEV align with a flaw that requires authentication and yields disclosure rather than code execution. The source-code fix corroborates the mechanism: the patch adds an is_uploaded_file() check before file_exists() in ImportService.php, confirming the root cause was trusting an attacker-supplied path as if it were an uploaded file. Realistic priority is 'patch in normal cycle' rather than emergency, elevated somewhat for multi-tenant or sensitive Nextcloud deployments where any authenticated user could read server-side files (e.g. config, other users' data on disk).

An authenticated Nextcloud user with access to the Tables app initiates a table import but supplies a path pointing to an arbitrary file already on the server rather than an uploaded spreadsheet. If that file is a format PhpSpreadsheet can parse, its contents are read and returned to the attacker, disclosing server-side data such as configuration or other users' files. No public exploit code was identified, though the fix diff confirms the vulnerable code path.