CVE-2025-66549

—

CVSS 3.1

2.7 low

EPSS

<1%p22

Published

Dec 5, 2025 (Dec 5, 2025)

Modified

Jun 17, 2026

Description

Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.

Vendors: nextcloud
Products: desktop
Weakness: CWE-209
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.