CVE-2025-58051

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-58051
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58051.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-58051
Aliases
  • GHSA-wpp5-4w35-pxq6
Published
2025-10-16T16:48:19.618Z
Modified
2026-04-10T05:31:16.262863Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table
Details

Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user. It is recommended that the Nextcloud Tables app is upgraded to 0.7.6, 0.8.8 or 0.9.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-841"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58051.json"
}
References

Affected packages

Git / github.com/nextcloud/tables

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/tables
Events
Introduced
61dd0cf23248ce4860566ad89a5577e30ca955ee
Fixed
01491d6061ecbb50684f2a7470d03b154d4b90aa
Database specific 
{
    "versions": [
        {
            "introduced": "0.7.0"
        },
        {
            "fixed": "0.7.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/tables
Events
Introduced
412c2b3177305e5b84701067690ce1af31e7d58d
Fixed
ed9745a1d5dccd6031e8c674834ceee65b213f42
Database specific 
{
    "versions": [
        {
            "introduced": "0.8.0"
        },
        {
            "fixed": "0.8.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/tables
Events
Introduced
903a2312c8885cfe83fe71db18f7c3de47a3dee8
Fixed
369d70c52b14c978f89c718b9d02910a4ea697f8
Database specific 
{
    "versions": [
        {
            "introduced": "0.9.0"
        },
        {
            "fixed": "0.9.5"
        }
    ]
}

Affected versions

v0.*
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58051.json"