CVE-2024-52520: Nextcloud Server

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

Affected products

• Nextcloud Nextcloud Server: from 27.0.0, before 27.1.11.8 (fixed in 27.1.11.8); from 28.0.0, before 28.0.10 (fixed in 28.0.10); from 29.0.0, before 29.0.7 (fixed in 29.0.7)

Published 2024-11-15. Last modified 2026-06-17.