CVE-2025-66552CWE-778

CVE-2025-66552

Medium · published December 5, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
22.7
In the wild
Unconfirmed
What it is

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.7th percentile
Weakness
CWE-778 · Insufficient Logging
Published
2025-12-05T22:16Z
Affected products (4)
ProductVersionsFixed in
nextcloud/nextcloud_server≥ 30.0.0, < 30.0.930.0.9
nextcloud/nextcloud_server≥ 30.0.0, < 30.0.930.0.9
nextcloud/nextcloud_server≥ 31.0.0, < 31.0.131.0.1
nextcloud/nextcloud_server≥ 31.0.0, < 31.0.131.0.1
References (4)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-ww9m-f8j4-jj9x · [email protected]https://github.com/nextcloud/server/commit/7cc005c43c72bc384848cf8cb851895827c412f6 · [email protected]https://github.com/nextcloud/server/pull/50992 · [email protected]https://hackerone.com/reports/2890071 · [email protected]
EPSS history
Timeline
  • 05 DEC 16:36Z
    Nextcloud Server admin_audit does not log all actions on files in groupfolders
    cvelistv5