CVE-2025-66545CWE-707

CVE-2025-66545

Low · published December 5, 2025

CVSS v3.1
3.5
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash bin. This vulnerability is fixed in 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00282 · 19.7th percentile
Weakness
CWE-707 · Improper Neutralization
Published
2025-12-05T23:15Z
Affected products (6)
ProductVersionsFixed in
nextcloud/group_folders< 14.0.1114.0.11
nextcloud/group_folders≥ 15.0.0, < 15.3.1215.3.12
nextcloud/group_folders≥ 16.0.0, < 16.0.1516.0.15
nextcloud/group_folders≥ 17.0.0, < 17.0.1417.0.14
nextcloud/group_folders≥ 18.0.0, < 18.1.818.1.8
nextcloud/group_folders≥ 19.0.0, < 20.1.220.1.2
References (4)
https://github.com/nextcloud/groupfolders/commit/bbe87ebed8da23e9df4db637a76fbc8d36439d58 · [email protected]https://github.com/nextcloud/groupfolders/issues/4041 · [email protected]https://github.com/nextcloud/groupfolders/pull/4076 · [email protected]https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vrq-fhmf-c49m · [email protected]
EPSS history
Timeline
  • 05 DEC 17:44Z
    Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin
    cvelistv5