Vulnerability · Published Dec 5, 2025 · Assigned by GitHub_M

CVE-2025-66549Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory

Low 2.4

In plain English

A low-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.3%top 75.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	nextcloud-desktop	no fix listed	DEBIAN-CVE-2025-66549
Debian:13	nextcloud-desktop	3.16.6-3	DEBIAN-CVE-2025-66549
Debian:14	nextcloud-desktop	3.16.6-3	DEBIAN-CVE-2025-66549
Ubuntu:22.04:LTS	nextcloud-desktop	no fix listed	UBUNTU-CVE-2025-66549
Ubuntu:24.04:LTS	nextcloud-desktop	no fix listed	UBUNTU-CVE-2025-66549

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 3.16.5

Weakness: CWE-209 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h9xj-qh76-q3hw x_refsource_CONFIRM
https://github.com/nextcloud/desktop/pull/8330 x_refsource_MISC
https://github.com/nextcloud/desktop/commit/36d6c234d42b06a6f2e9de3e413a5c3c625edad6 x_refsource_MISC
https://hackerone.com/reports/3159877 x_refsource_MISC