CVE-2025-47793: Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file
Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed logged-in users to upload files exceeding the group folder quota. Nextcloud Server versions 30.0.2 and 29.0.9, Nextcloud Enterprise Server versions 30.0.2, 29.0.9, or 28.0.12, and Nextcloud Groupfolders app 18.0.3, 17.0.5, and 16.0.11 fix the issue. No known workarounds are available.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47793?
CVE-2025-47793 has been classified with a moderate severity level due to its impact on group folder permissions.
How do I fix CVE-2025-47793?
To fix CVE-2025-47793, upgrade to Nextcloud Server versions 30.0.2, 29.0.9, or 28.0.1, and Nextcloud Enterprise Server versions 30.0.2 or 29.0.9.
Which versions of Nextcloud are affected by CVE-2025-47793?
CVE-2025-47793 affects Nextcloud Server versions prior to 30.0.2, 29.0.9, and 28.0.1, as well as Nextcloud Enterprise Server versions prior to 30.0.2 and 29.0.9.
What functionality does the Nextcloud Groupfolders app provide related to CVE-2025-47793?
The Nextcloud Groupfolders app allows for admin-configured shared folders for group or team collaboration, which is impacted by CVE-2025-47793.
Is there a workaround for CVE-2025-47793 before applying the patch?
There are no official workarounds for CVE-2025-47793, and users are advised to upgrade to the fixed versions to mitigate the vulnerability.