CVE-2025-66550: Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that…

PriorityP431medium5.7CVSS 3.1

AVNACLPRLUIRSUCNIHAN

EPSS

0.28%

19.4th percentile

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
nextcloud	calendar	>= 4.0.0 < 4.7.17	4.7.17
nextcloud	calendar	>= 5.0.0 < 5.2.4	5.2.4
nextcloud	security-advisories	< 4.7.17	4.7.17
nextcloud	security-advisories	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.