2.7

CVE-2025-66549

Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory

Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory

Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.
Mögliche Gegenmaßnahme
Desktop: * Disable app Files Lock
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Desktop Version >= 3.0.0 < 3.16.5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt Desktop
Version >= 3.0.0, < 3.16.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.164
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
security-advisories@github.com 2.4 0.9 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
CWE-209 Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h9xj-qh76-q3hw
Patch
Vendor Advisory
https://github.com/nextcloud/desktop/pull/8330
Issue Tracking
https://github.com/nextcloud/desktop/commit/36d6c234d42b06a6f2e9de3e413a5c3c625edad6
Patch
https://hackerone.com/reports/3159877
Vendor Advisory
Permissions Required
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h9xj-qh76-q3hw
Third Party Advisory