CVE-2025-66552
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Dec 5, 2025
CISA due date
—
The record
Nextcloud Server admin_audit does not log all actions on files in groupfolders
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | nextcloud-server-30 | 0 | 30.0.17-r0 |
| Chainguard | nextcloud-server-30-apache2-config | 0 | 30.0.17-r0 |
Related vulnerabilities
- CVE-2026-30964 web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to… Also affects nextcloud-server-30
- CVE-2025-66547 Nextcloud Server users can modify tags on files that do not belong to them Also affects nextcloud-server-30
- CVE-2025-14761 Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write… Also affects nextcloud-server-30-apache2-config
- CVE-2025-66510 Nextcloud Server Contacts Search allowed users to retrieve contact information of other… Also affects nextcloud-server-30-apache2-config
- CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass Also affects nextcloud-server-30-apache2-config
- CVE-2020-37268 Print Assumptions does not report that a definition was produced while universe checking… CWE-778
- GHSA-gfp8-mp24-5vxg @hulumi/baseline: CloudTrail selector tampering events were not fully detected CWE-778
- CVE-2026-32803 Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0… CWE-778