CVE-2025-66550

CWE-2412 documents2 sources
Severity
5.7MEDIUM
EPSS
0.0%
top 90.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nextcloud Security-advisoriesNextcloud Calendar
Timeline
PublishedDec 5

Description

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:NExploitability: 2.1 | Impact: 3.6

Affected Packages2 packages

▶NVDnextcloud/calendar4.0.0 — 4.7.17+1
▶CVEListV5nextcloud/security-advisories< 4.7.17+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
CVEList
Nextcloud Calendar attachments of local files are offered to downloaded↗2025-12-05
▶