CVE-2025-66545

low-risk
Published 2025-12-05

Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash bin. This vulnerability is fixed in 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.5/10 Low
NETWORK / LOW complexity

Affected Products (1)

Group Folders

Affected Vendors

Nextcloud

References (4)

Patch https://github.com/nextcloud/groupfolders/commit/bbe87ebed8da23e9df4db637a76fbc8...
Issue Tracking https://github.com/nextcloud/groupfolders/issues/4041
Issue Tracking https://github.com/nextcloud/groupfolders/pull/4076
Patch https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vrq-f...
21
/ 100
low-risk
Severity 16/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal