CVE-2025-66549 LOW

CVE-2025-66549: Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory

Vendor Nextcloud

Product security-advisories

Weakness CWE-209 · Error message info leak

Published December 5, 2025

Last update December 8, 2025

View on NVD All CVEs

CVSS base score

2.4/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction Required

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.

Key dates

02Disclosure timeline

December 5, 2025 CVE published

December 8, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-66549 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/209.html

Related vulnerabilities

04Related CVE

CVE-2026-29110 Cryptomator: Leaking of cleartext paths into log file in non-debug mode CVE-2026-43873 WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server CVE-2026-30835 Parse Server: Malformed `$regex` query leaks database error details in API response CVE-2026-47248 Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers CVE-2026-41730 Spring Data REST exposes persistence-layer internals in error responses