CVE-2025-66548

MediumCVSS 5.5/10Last modified Oct 15, 2026

Description

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	>= 1.15.0-beta.1, < 1.15.1; >= 1.14.0-beta.1, < 1.14.4; < 1.12.7

References

https://github.com/nextcloud/deck/commit/afa95d3c507465b9d31af7c88c69b76711ef185aPatch
https://github.com/nextcloud/deck/pull/6671Issue Tracking
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xjvq-xvr7-xpg6Patch, Vendor Advisory
https://hackerone.com/reports/2326618Permissions Required, Vendor Advisory

Timeline

Published: Dec 5, 2025
Last modified: Oct 15, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-665492.7Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encryp CVE-2025-66553.3PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to d CVE-2025-665505.7Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted CVE-2025-665514.3Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create CVE-2025-665524.3Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect pat CVE-2025-665534.3Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to vi CVE-2025-665545.4Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2 CVE-2025-665558.8AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes CVE-2025-665564.3Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able t CVE-2025-665574.3Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. CVE-2025-665584.3Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed CVE-2025-665598.0Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental proper