CVE-2025-66547
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Dec 5, 2025
CISA due date
—
The record
Nextcloud Server users can modify tags on files that do not belong to them
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | nextcloud-server-30 | 0 | 30.0.17-r0 |
| Chainguard | nextcloud-server-30-apache2-config | 0 | 30.0.17-r0 |
Related vulnerabilities
- CVE-2026-30964 web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to… Also affects nextcloud-server-30
- CVE-2025-66552 Nextcloud Server admin_audit does not log all actions on files in groupfolders Also affects nextcloud-server-30
- CVE-2025-14761 Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write… Also affects nextcloud-server-30-apache2-config
- CVE-2025-66510 Nextcloud Server Contacts Search allowed users to retrieve contact information of other… Also affects nextcloud-server-30-apache2-config
- CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass Also affects nextcloud-server-30-apache2-config
- CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before… CWE-639
- CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-639
- CVE-2026-105755 vLLM is an inference and serving engine for large language models. CWE-639