CVE-2025-66549CWE-209

CVE-2025-66549

Low · published December 5, 2025

CVSS v3.1
2.4
EPSS
0%
Percentile
21.2
In the wild
Unconfirmed
What it is

Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.

The record
Technical detail
CVSS v3.1
2.4 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00297 · 21.2th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2025-12-05T23:15Z
Affected products (1)
ProductVersionsFixed in
nextcloud/desktop≥ 3.0.0, < 3.16.53.16.5
References (4)
https://github.com/nextcloud/desktop/commit/36d6c234d42b06a6f2e9de3e413a5c3c625edad6 · [email protected]https://github.com/nextcloud/desktop/pull/8330 · [email protected]https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h9xj-qh76-q3hw · [email protected]https://hackerone.com/reports/3159877 · [email protected]
EPSS history
Timeline
  • 05 DEC 17:47Z
    Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory
    cvelistv5