CVE-2023-25579

Name of the Vulnerable Software and Affected Versions Nextcloud server versions prior to 25.0.2 Nextcloud server versions prior to 24.0.8 Nextcloud server versions prior to 23.0.12

Description The issue concerns the OCFilesNodeFolder::getFullPath() function, which was validating and normalizing strings in the wrong order. This function is used in the newFile() and newFolder() items, potentially allowing the creation of paths outside of one's own space and overwriting data from other users with crafted paths.

Recommendations For versions prior to 25.0.2, upgrade to version 25.0.2 or later. For versions prior to 24.0.8, upgrade to version 24.0.8 or later. For versions prior to 23.0.12, upgrade to version 23.0.12 or later.