CVE-2025-66548

Опубликовано: 05 дек. 2025

Источник: nvd

CVSS3: 3.3

CVSS3: 5.5

EPSS Низкий

Описание

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.

Ссылки

https://github.com/nextcloud/deck/commit/afa95d3c507465b9d31af7c88c69b76711ef185a
Patch
https://github.com/nextcloud/deck/pull/6671
Issue Tracking
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xjvq-xvr7-xpg6
Patch
Vendor Advisory
https://hackerone.com/reports/2326618
Permissions Required
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*

Версия до 1.12.7 (исключая)

cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*

Версия от 1.14.0 (включая) до 1.14.4 (исключая)

cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*

Версия от 1.15.0 (включая) до 1.15.1 (исключая)

EPSS

Процентиль: 1%

0.0001

Низкий

3.3 Low

CVSS3

5.5 Medium

CVSS3

Дефекты

CWE-116

EPSS

Процентиль: 1%

0.0001

Низкий

3.3 Low

CVSS3

5.5 Medium

CVSS3

Дефекты

CWE-116