PT-2025-49290 · Nextcloud+1 · Nextcloud Calendar+1

Published 2025-12-05 · Updated 2026-01-29 · CVE-2025-66550

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Calendar versions prior to 4.7.17 Nextcloud Calendar versions prior to 5.2.4

Description A malicious user could create a calendar event with a specially crafted attachment that links to a file on the same Nextcloud server. This action would result in the file being downloaded without requiring user confirmation. The issue involves the handling of attachments within calendar events. The vulnerability is triggered when an attachment contains a link to a file hosted on the same Nextcloud instance.

Recommendations Update Nextcloud Calendar to version 4.7.17 or later. Update Nextcloud Calendar to version 5.2.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-241

Related Identifiers

BDU:2026-03381

CVE-2025-66550

GHSA-F29C-PPMV-8MCV

Affected Products

Nextcloud Calendar

Red Os

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66550.json · Exploit
• https://github.com/nextcloud/calendar/commit/63a6c398db01391eb9fd5297a0d4c3d6e614f769 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f29c-ppmv-8mcv · Vendor Advisory
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03381 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66550 · Security Note
• https://hackerone.com/reports/3112033 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66550 · Vendor Advisory
• https://github.com/nextcloud/calendar/pull/6971 · Note
• https://twitter.com/VulmonFeeds/status/1997007454287089750 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nextcloud-app-calendar-cve-2025-66550-7.3 · Note
• https://t.me/cveNotify/145321 · Telegram Post
• https://twitter.com/dailycve/status/1998809206942740880 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-nextcloud-app-calendar-cve-2025-66550-8.0 · Note
• https://twitter.com/CVEnew/status/1996994592055460046 · Twitter Post