CVE-2025-66548: nextcloud deck

csirt@kutim:~/threat-intel/cve/CVE-2025-66548

CVSS 5.5 · Medium EPSS 0,15%

Kerentanan Improper Encoding or Escaping of Output pada nextcloud deck. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.

Rincian

Terbit di NVD: 5 Desember 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-116: Improper Encoding or Escaping of Output
EPSS (30 hari): 0,15% peluang dieksploitasi; lebih tinggi dari 4,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
nextcloud	deck	Semua versi sebelum 1.12.7
nextcloud	deck	Versi 1.14.0 hingga sebelum 1.14.4
nextcloud	deck	Versi 1.15.0 hingga sebelum 1.15.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xjvq-xvr7-xpg6 patch · advisory vendor
https://hackerone.com/reports/2326618 permissions required · advisory vendor
https://github.com/nextcloud/deck/commit/afa95d3c507465b9d31af7c88c69b76711ef185a patch
https://github.com/nextcloud/deck/pull/6671 issue tracking

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.