CVE-2025-58051
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user.
Risk Assessment
The vulnerability allows unauthorized access to files on the server and leakage of their content to the user. This could lead to disclosure of sensitive data.
Recommendation
Upgrade the Nextcloud Tables app to version 0.7.6, 0.8.8, or 0.9.5. Also consider restricting table import permissions to trusted users only.
Other vulnerabilities in Nextcloud Tables
See all- CVE-2026-45722High
In Nextcloud Tables (versions 0.9.0 to 0.9.7 and 1.0.0 to 1.0.2), missing sanitization allows a user with access to perform a limited SQL injection in the ORDER BY clause, enabling extraction of a single bit per request or database delay.
- CVE-2026-45544Medium
Nextcloud Tables from version 0.8.0 to before 1.0.4 exposes view filter criteria to users with read-only permissions. This issue is patched in versions 1.0.4 and 2.0.0.
- CVE-2025-66551Medium
Nextcloud Tables before versions 0.8.6 and 0.9.3 allows a malicious user to create their own table and then move a column to a victim's table. This vulnerability is fixed in versions 0.8.6 and 0.9.3.
Original NVD description (English source)
Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user. It is recommended that the Nextcloud Tables app is upgraded to 0.7.6, 0.8.8 or 0.9.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS