CVE-2025-66545— Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin
Quick assessment
Affected
nextcloud security-advisories
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Team folders是Nextcloud开源的一个文件共享软件。 Team folders 14.0.11之前版本、15.3.12之前版本、16.0.15之前版本、17.0.14之前版本、18.1.8之前版本、19.1.8之前版本和20.1.2之前版本存在安全漏洞，该漏洞源于只读权限用户可从回收站恢复文件，可能导致权限绕过。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-66545
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin
Source: CVE Program / CVE List V5
Vulnerability Description
Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash bin. This vulnerability is fixed in 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对消息或数据结构的处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Team folders 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Team folders是Nextcloud开源的一个文件共享软件。 Team folders 14.0.11之前版本、15.3.12之前版本、16.0.15之前版本、17.0.14之前版本、18.1.8之前版本、19.1.8之前版本和20.1.2之前版本存在安全漏洞，该漏洞源于只读权限用户可从回收站恢复文件，可能导致权限绕过。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nextcloud | security-advisories | < 14.0.11 | - |
|
II. Public POCs for CVE-2025-66545
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-66545
请登录查看更多情报信息。
Same Patch Batch · nextcloud · 2025-12-05 · 19 CVEs total
| CVE-2025-66551 | 6.3 MEDIUM | Nextcloud Tables is missing an ownership check which allows moving columns into tables of |
| CVE-2025-66550 | 5.7 MEDIUM | Nextcloud Calendar attachments of local files are offered to downloaded |
| CVE-2025-66512 | 5.4 MEDIUM | Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud |
| CVE-2025-66557 | 5.4 MEDIUM | Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other |
| CVE-2025-66511 | 4.8 MEDIUM | Nextcloud Calendar app used predictable proposal participant tokens |
| CVE-2025-66510 | 4.5 MEDIUM | Nextcloud Server Contacts Search allowed users to retrieve contact information of other us |
| CVE-2025-66553 | 4.3 MEDIUM | Nextcloud Tables app allowed users to view columns metadata information of any table |
| CVE-2025-66513 | 4.3 MEDIUM | Nextcloud Tables app share information not limited to relevant users |
| CVE-2025-66552 | 4.3 MEDIUM | Nextcloud Server admin_audit does not log all actions on files in groupfolders |
| CVE-2025-66547 | 4.3 MEDIUM | Nextcloud Server users can modify tags on files that do not belong to them |
| CVE-2025-66514 | 3.5 LOW | Nextcloud Mail stored HTML injection in subject text |
| CVE-2025-66554 | 3.5 LOW | Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title fie |
| CVE-2025-66556 | 3.5 LOW | Nextcloud talk allows participants to blindly delete poll drafts of other users by ID |
| CVE-2025-66548 | 3.3 LOW | Nextcloud Deck app allows to spoof file extensions by using RTLO characters |
| CVE-2025-66546 | 3.3 LOW | Nextcloud Calendar app allowed booking appointments without the generated token |
| CVE-2025-66558 | 3.1 LOW | Nextcloud Twofactor WebAuthn app was updated based on public key |
| CVE-2025-66515 | 2.7 LOW | Nextcloud Approval app allows users to request approval for other users file |
| CVE-2025-66549 | 2.4 LOW | Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end |
IV. Related Vulnerabilities
Same product: security-advisories
-
CVE-2026-24754
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripti -
CVE-2026-45810
Nextcloud: Propfind requests for file comments allowed to lo -
CVE-2026-45722
Nextcloud: Tables app allows limited SQLi in ORDER BY with m -
CVE-2026-45691
Nextcloud: Bypass of second factor authentication on DAV end -
CVE-2026-45690
Nextcloud: Two-Factor Authentication Bypass via Pending Sess
Same vendor: nextcloud
-
CVE-2026-45810
Nextcloud: Propfind requests for file comments allowed to lo -
CVE-2026-45722
Nextcloud: Tables app allows limited SQLi in ORDER BY with m -
CVE-2026-45691
Nextcloud: Bypass of second factor authentication on DAV end -
CVE-2026-45690
Nextcloud: Two-Factor Authentication Bypass via Pending Sess -
CVE-2026-45545
Nextcloud: SQL Injection in Column Type Parameter Allows Arb
Same weakness: CWE-707
-
CVE-2026-4249
Denial of Service via Malicious JSON Payloads in Throttling -
CVE-2025-26633
Microsoft Management Console Security Feature Bypass Vulnera -
CVE-2024-43572
Microsoft Management Console Remote Code Execution Vulnerabi -
CVE-2022-4729
Graphite Web Template Name cross site scripting -
CVE-2022-4728
Graphite Web Cookie cross site scripting
V. Comments for CVE-2025-66545
No comments yet