Vulnerability · Published Dec 5, 2025 · Assigned by GitHub_M

CVE-2025-66552Nextcloud Server admin_audit does not log all actions on files in groupfolders

Medium 4.3

In plain English

A medium-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 73.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>= 32.0.0beta1, < 32.0.1< 31.0.9

Weakness: CWE-778 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-ww9m-f8j4-jj9x x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/50992 x_refsource_MISC
https://github.com/nextcloud/server/commit/7cc005c43c72bc384848cf8cb851895827c412f6 x_refsource_MISC
https://hackerone.com/reports/2890071 x_refsource_MISC