PT-2025-49298 · Nextcloud+2 · Nextcloud Desktop+2

Published 2025-01-01 · Updated 2025-12-29 · CVE-2025-66549

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop versions prior to 3.16.5

Description Nextcloud Desktop is a desktop sync client for Nextcloud. Before version 3.16.5, the file path was transmitted unencrypted when attempting to manually lock a file within an end-to-end encrypted directory. This allowed administrators to view the file path in server log files.

Recommendations Update to version 3.16.5 or later.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

ALT-PU-2025-16287

CVE-2025-66549

GHSA-H9XJ-QH76-Q3HW

Affected Products

Alt Linux

Debian

Nextcloud Desktop

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66549.json · Exploit
• https://github.com/nextcloud/desktop/commit/36d6c234d42b06a6f2e9de3e413a5c3c625edad6 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h9xj-qh76-q3hw · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-66549 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66549 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-66549 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-66549 · Security Note
• https://hackerone.com/reports/3159877 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-66549 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-66549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66549 · Security Note
• https://github.com/nextcloud/desktop/pull/8330 · Note
• https://twitter.com/dailycve/status/1998514100176039949 · Twitter Post
• https://t.me/CVEtracker/38948 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1997125199154593811 · Twitter Post