CVE-2025-66550
BaseFortify
Publication date: 2025-12-05
Last updated on: 2025-12-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nextcloud | calendar | From 4.0.0 (inc) to 4.7.17 (exc) |
| nextcloud | calendar | From 5.0.0 (inc) to 5.2.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-241 | The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Nextcloud Calendar allows a malicious user to create a calendar event with a specially crafted attachment that links to a file on the same Nextcloud server. When another user views this event, the linked file is downloaded automatically without the user's confirmation. This behavior occurs in versions prior to 4.7.17 and 5.2.4 and has been fixed in those versions.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized downloading of files from the Nextcloud server without user consent, potentially exposing sensitive or private data. This could result in information leakage or unauthorized access to internal files, impacting data confidentiality and user trust.
What immediate steps should I take to mitigate this vulnerability?
Update Nextcloud Calendar to version 4.7.17 or 5.2.4 or later, as these versions contain the fix for this vulnerability.