Is Nextcloud Server 29.0.4 affected?

Vulnerabilities affecting 29.0.4

• 6.4
  CVE-2025-47790 Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 3… fixed in 29.0.15
• 5.7
  CVE-2024-52520 Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find ope… fixed in 29.0.7
• 4.6
  CVE-2024-52523 Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the fronte… fixed in 29.0.9
• 4.6
  CVE-2024-52517 Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain… fixed in 29.0.8
• 4.4
  CVE-2024-52518 Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external stor… fixed in 29.0.9
• 4.3
  CVE-2025-47793 Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.… fixed in 29.0.9
• 4.3
  CVE-2025-47791 Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently… fixed in 29.0.10
• 3.0
  CVE-2024-52516 Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously… fixed in 29.0.5
• 2.7
  CVE-2024-52519 Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextclou… fixed in 29.0.7
• 2.6
  CVE-2025-47794 Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13… fixed in 29.0.13
• 2.6
  CVE-2024-52513 Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in T… fixed in 29.0.8
• 2.6
  CVE-2024-52521 Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely be… fixed in 29.0.7
• 1.8
  CVE-2024-52525 Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved… fixed in 29.0.9

Newer releases