QwikSec

Security Database

CVE

CWE

Training

CVE-2025-66549

Published: Dec 5, 2025

Modified: Dec 8, 2025

PUBLISHED

CVSS v3.1

2.4

LOW

Description

Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.

Vendor	Product	Versions
nextcloud	security-advisories	affected `< 3.16.5`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h9xj-qh76-q3hw

x_refsource_CONFIRM

https://github.com/nextcloud/desktop/pull/8330

x_refsource_MISC

https://github.com/nextcloud/desktop/commit/36d6c234d42b06a6f2e9de3e413a5c3c625edad6

x_refsource_MISC

https://hackerone.com/reports/3159877

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.