CVE-2025-66550

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nextcloud/calendar/commit/63a6c398db01391eb9fd5297a0d4c3d6e614f769	Patch
https://github.com/nextcloud/calendar/pull/6971	Issue Tracking
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f29c-ppmv-8mcv	Patch Vendor Advisory
https://hackerone.com/reports/3112033	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nextcloud:calendar::::::::
	cpe:2.3:a:nextcloud:calendar::::::::

History

18 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Nextcloud Calendar es una aplicación de calendario para Nextcloud. Versiones anteriores a?4.7.17 y?5.2.4, cuando un usuario malicioso crea un evento de calendario con un adjunto creado que enlaza a un enlace de descarga de un archivo en el mismo servidor Nextcloud, el archivo sería descargado sin que el usuario confirme la acción. Esta vulnerabilidad está corregida en?4.7.17 y?5.2.4.

Information

Published : 2025-12-05 17:16

Updated : 2026-10-18 14:10

NVD link : CVE-2025-66550

Mitre link : CVE-2025-66550

CVE.ORG link : CVE-2025-66550

JSON object : View

Products Affected

nextcloud

calendar

CWE

CWE-241

Improper Handling of Unexpected Data Type

{"id": "CVE-2025-66550", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66550", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T18:37:20.458733Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": ">= 5.0.0-rc.1, < 5.2.4"}, {"status": "affected", "version": "< 4.7.17"}]}]}], "published": "2025-12-05T17:16:05.500", "references": [{"url": "https://github.com/nextcloud/calendar/commit/63a6c398db01391eb9fd5297a0d4c3d6e614f769", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/calendar/pull/6971", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f29c-ppmv-8mcv", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/3112033", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-241"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4."}, {"lang": "es", "value": "Nextcloud Calendar es una aplicaci\u00f3n de calendario para Nextcloud. Versiones anteriores a?4.7.17 y?5.2.4, cuando un usuario malicioso crea un evento de calendario con un adjunto creado que enlaza a un enlace de descarga de un archivo en el mismo servidor Nextcloud, el archivo ser\u00eda descargado sin que el usuario confirme la acci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en?4.7.17 y?5.2.4."}], "lastModified": "2026-10-18T14:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B86471C-96D9-4152-BD53-8AC98B0C428D", "versionEndExcluding": "4.7.17", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "833B51DE-8445-40F4-A4D4-E7B88F3C2B0C", "versionEndExcluding": "5.2.4", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}