Medium severity · published Dec 5, 2025
CVE-2025-66552
Nextcloud Server is a self hosted personal cloud system
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NS
Nextcloud Server · Nextcloud
30.0.0 before 30.0.9; 30.0.0 before 30.0.9; 31.0.0 before 31.0.1; 31.0.0 before 31.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66552
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66552
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-ww9m-f8j4-jj9x
Patch
https://github.com/nextcloud/server/commit/7cc005c43c72bc384848cf8cb851895827c412f6
Issue Tracking
https://github.com/nextcloud/server/pull/50992
Issue Tracking
https://hackerone.com/reports/2890071
More from Nextcloud Server
9.8
CVE-2023-49792
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform
9.8
CVE-2023-48306
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform
9.8
CVE-2021-32802
Nextcloud server is an open source, self hosted personal cloud
9.8
CVE-2021-32726
Nextcloud Server is a Nextcloud package that handles data storage
9.8
CVE-2021-22915
Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations