Nextcloud Server CVE-2025-64011

Attacker must hold a valid authenticated account of any privilege level on a Nextcloud Server 30.0.0 instance; no prior sharing relationship with the victim is needed. Exploitation targets the /core/preview endpoint by manipulating the fileId parameter to reference files owned by other users. LIMITING FACTORS: authentication is mandatory (the flaw is not reachable by anonymous/unauthenticated attackers), disclosure is restricted to preview renderings rather than full original file content, only files for which previews can be generated are exposed, and the issue is tied to version 30.0.0 specifically. Multi-user/multi-tenant deployments are at materially higher practical risk than single-user instances.

This is a genuine but moderate-severity information-disclosure flaw, not a top-tier priority. The CVSS 3.1 base score is 4.3 (Medium), and the signals are internally consistent: AV:N/AC:L/UI:N make it easy to trigger remotely, but PR:L means the attacker must already hold a valid authenticated account on the target Nextcloud instance, and impact is limited to C:L (I:N, A:N) because only file previews - not full file contents - are exposed. The EPSS score of 0.27% (19th percentile) is low, indicating no significant mass-exploitation signal. It is NOT on CISA KEV, so there is no confirmed active exploitation. However, publicly available exploit code exists (two referenced PoCs), which lowers the skill barrier and makes opportunistic abuse by insiders or compromised accounts plausible. Net assessment: a real authorization-bypass bug worth patching on multi-tenant instances, but the authentication requirement and preview-only disclosure keep it well below critical priority. The low EPSS despite public PoC availability suggests limited real-world weaponization to date.

A low-privileged but authenticated user (or an attacker who has phished/compromised any single account) on a shared Nextcloud 30.0.0 instance iterates through fileId values and requests /core/preview for each, harvesting preview renderings of other tenants' documents and images without any sharing relationship. Public PoC code (two referenced exploits) exists, so no custom tooling is required - the attacker simply replays the documented request with incrementing fileIds.