CVE-2025-65963

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

Files is a module for managing files inside spaces and user profiles. Prior to versions 0.16.11 and 0.17.2, insufficient authorization checks allow non-member users to create new folders, up- and download files as a ZIP archive in public spaces. Private spaces are not affected. This issue has been patched in versions 0.16.11 and 0.17.2.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284 CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Nov 26, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-659648.8n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through CVE-2025-659658.2Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting v CVE-2025-659668.1OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts thro CVE-2025-65970.0Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This is CVE-2025-65997.5An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could CVE-2025-659956.5When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs CVE-2025-659987.5Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the defa CVE-2025-66004.3An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the n CVE-2025-660007.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker co CVE-2025-660018.8NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authentici CVE-2025-660026.9An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrar CVE-2025-660037.3An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if