PT-2025-49269 · Nextcloud+1 · Nextcloud Server+1

Published 2025-12-05 · Updated 2026-01-29 · CVE-2025-66552

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 30.0.9 Nextcloud Server versions prior to 31.0.1

Description An issue exists in Nextcloud Server and Enterprise Server related to incorrect path handling with groupfolders. This resulted in the admin audit app failing to log all actions on files and folders within groupfolders.

Recommendations Update Nextcloud Server to version 30.0.9 or later. Update Nextcloud Server to version 31.0.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-778

Related Identifiers

BDU:2026-03380

CVE-2025-66552

GHSA-WW9M-F8J4-JJ9X

Affected Products

Nextcloud Server

Red Os

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66552.json · Exploit
• https://github.com/nextcloud/server/commit/7cc005c43c72bc384848cf8cb851895827c412f6 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-ww9m-f8j4-jj9x · Vendor Advisory
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66552 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66552 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03380 · Security Note
• https://hackerone.com/reports/2890071 · Vendor Advisory
• https://github.com/nextcloud/server/pull/50992 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nextcloud-cve-2025-66552-7.3 · Note
• https://t.me/cveNotify/145328 · Telegram Post
• https://twitter.com/dailycve/status/1998810047741305017 · Twitter Post
• https://twitter.com/CVEnew/status/1996985616328790116 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1997004894440460427 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-nextcloud-cve-2025-66552-8.0 · Note