CVE-2024-52515: nextcloud server — Fix

Description

Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended that the Nextcloud Server is upgraded to 27.1.10, 28.0.6 or 29.0.1 and Nextcloud Enterprise Server is upgraded to 24.0.12.15, 25.0.13.10, 26.0.13.4, 27.1.10, 28.0.6 or 29.0.1.

Is your site exposed to CVE-2024-52515?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.7

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-706 CWE-706

Affected Products

Vendor	Product	Versions
nextcloud	nextcloud_server	24.0.0 — 24.0.12.15
nextcloud	nextcloud_server	25.0.0 — 25.0.13.10
nextcloud	nextcloud_server	26.0.0 — 26.0.13.4
nextcloud	nextcloud_server	27.0.0 — 27.1.10
nextcloud	nextcloud_server	27.0.0 — 27.1.10
nextcloud	nextcloud_server	28.0.0 — 28.0.6
nextcloud	nextcloud_server	28.0.0 — 28.0.6
nextcloud	nextcloud_server	29.0.0 — 29.0.1
nextcloud	nextcloud_server	29.0.0 — 29.0.1

References

Advisories & Patches

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5m5g-hw8c-2236 https://github.com/nextcloud/server/commit/7e1c30f82a63fbea8c269e0eec38291377f32604

Other References

https://github.com/nextcloud/server/pull/45340 https://hackerone.com/reports/2484499

Frequently Asked Questions

What is CVE-2024-52515? +

Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended that the Nextcloud Server is upgraded to 27.1.10, 28.0.6 or 29.0.1 and Nextcloud Enterprise Server is upgraded to 24.0.12.15, 25.0.13.10, 26.0.13.4, 27.1.10, 28.0.6 or 29.0.1. It has a CVSS v3.1 base score of 5.7 (MEDIUM).

How severe is CVE-2024-52515? +

CVE-2024-52515 has a CVSS v3.1 score of 5.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-52515? +

CVE-2024-52515 affects products from nextcloud, specifically: nextcloud_server. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-52515? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-13437

When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic …

CVE-2026-95275

Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy …

CVE-2024-51746

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may …

CVE-2014-125125

A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the …

CVE-2026-87720

Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through …

CVE-2026-65816 10.0

Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

CVE-2024-52515