Vulnerability in Nextcloud Server
CVE-2025-66552
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.003 (22.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 22.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Nextcloud Server
- Nextcloud Security-Advisories — versions >= 32.0.0beta1, < 32.0.1, < 31.0.9
Weakness classification (CWE)
References
- github.com/nextcloud/security-advisories/security/advisories/GHSA-ww9m-f8j4-jj9x (Patch, Vendor Advisory)
- github.com/nextcloud/server/pull/50992 (Issue Tracking)
- github.com/nextcloud/server/commit/7cc005c43c72bc384848cf8cb851895827c412f6 (Patch)
- hackerone.com/reports/2890071 (Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-66552?
- CVE-2025-66552 is a medium-severity vulnerability in Nextcloud Server, classified under CWE-778. CVSS score: 4.3/10. Published 2025-12-05.
- How severe is CVE-2025-66552?
- Medium severity. CVSS v3 base score is 4.3 out of 10.