CVE-2025-66549: nextcloud desktop

csirt@kutim:~/threat-intel/cve/CVE-2025-66549

CVSS 2.7 · Low EPSS 0,30%

Kerentanan Generation of Error Message Containing Sensitive Information pada nextcloud desktop. Skor CVSS 3.1 2.7 (Low) menurut NVD.

Deskripsi (NVD)

Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.

Rincian

Terbit di NVD: 5 Desember 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 2.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-209: Generation of Error Message Containing Sensitive Information
EPSS (30 hari): 0,30% peluang dieksploitasi; lebih tinggi dari 20,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
nextcloud	desktop	Versi 3.0.0 hingga sebelum 3.16.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h9xj-qh76-q3hw patch · advisory vendor
https://hackerone.com/reports/3159877 permissions required · advisory vendor
https://github.com/nextcloud/desktop/commit/36d6c234d42b06a6f2e9de3e413a5c3c625edad6 patch
https://github.com/nextcloud/desktop/pull/8330 issue tracking

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.