Use of Incorrectly-Resolved Name or Reference in Nextcloud Enterprise Server and Nextcloud Server - CVE-2024-52515

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incomplete sanitization of SVG files. A remote user can upload a manipulated SVG file referencing paths and gain access to sensitive information on the system.

Affected software

How to mitigate CVE-2024-52515

External References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5m5g-hw8c-2236
• https://github.com/nextcloud/server/pull/45340
• https://github.com/nextcloud/server/commit/7e1c30f82a63fbea8c269e0eec38291377f32604
• https://hackerone.com/reports/2484499

Related Security Bulletins

• Use of Incorrectly-Resolved Name or Reference in Nextcloud Server and Enterprise Server