CVE-2025-58051: Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table
Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user. It is recommended that the Nextcloud Tables app is upgraded to 0.7.6, 0.8.8 or 0.9.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nextcloud Tables appto a version that resolves this vulnerability.Fixed in 0.9.5
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58051?
CVE-2025-58051 has been rated as a high severity vulnerability due to its potential to allow unauthorized file access on the server.
How do I fix CVE-2025-58051?
To mitigate CVE-2025-58051, upgrade Nextcloud Tables to version 0.7.6, 0.8.8, or 0.9.5 or later.
What is affected by CVE-2025-58051?
CVE-2025-58051 affects Nextcloud Tables versions prior to 0.7.6, 0.8.8, and 0.9.5.
What types of files are impacted by CVE-2025-58051?
CVE-2025-58051 can allow unauthorized access to any files supported by the PhpSpreadsheet library during table imports.
What actions should I take if I cannot immediately update to a fixed version for CVE-2025-58051?
If immediate updates are not possible, review and restrict user permissions and access to prevent exploitation of CVE-2025-58051.