PT-2025-49298 · Nextcloud+2 · Nextcloud Desktop+2

CVE-2025-66549 · Publicado 2025-01-01 · Atualizado 2025-12-29

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop versions prior to 3.16.5

Description Nextcloud Desktop is a desktop sync client for Nextcloud. Before version 3.16.5, the file path was transmitted unencrypted when attempting to manually lock a file within an end-to-end encrypted directory. This allowed administrators to view the file path in server log files.

Recommendations Update to version 3.16.5 or later.

Exploit

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

ALT-PU-2025-16287

CVE-2025-66549

GHSA-H9XJ-QH76-Q3HW

Produtos afetados

Alt Linux

Debian

Nextcloud Desktop

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66549.json · Exploit
• https://github.com/nextcloud/desktop/pull/8330 · Nota
• https://github.com/nextcloud/desktop/commit/36d6c234d42b06a6f2e9de3e413a5c3c625edad6 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h9xj-qh76-q3hw · Aviso do Fabricante
• https://twitter.com/dailycve/status/1998514100176039949 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-66549 · Aviso do Fabricante
• https://t.me/CVEtracker/38948 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-66549 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1997125199154593811 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2025-66549 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2025-66549 · Nota de Segurança
• https://hackerone.com/reports/3159877 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2025-66549 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1997009583244800171 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-66549 · Aviso do Fabricante