CVE-2024-52521

5.3 mediumEPSS 0.4%

Medium (5.3) in nextcloud nextcloud server. EPSS 0.4% chance of exploitation in the next 30 days.

Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE: CWE-328
Published: 2024-11-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:nextcloud_server

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2q6f-gjgj-7hp4
https://github.com/nextcloud/server/commit/a933ba1fdba77e7d8c6b8ff400e082cf853ea46d
https://github.com/nextcloud/server/pull/47769

Check your stack JSON