CVE-2025-66549 Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory
Nextcloud Desktop client leaks unencrypted file paths to the server when locking files in encrypted directories, exposing sensitive data to administrators.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-66549?
CVE-2025-66549 is a low-severity vulnerability in nextcloud security-advisories, published on 5 Dec 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.
Weakness: CWE-209
Which versions are affected by CVE-2025-66549?
It affects 1 product.
Products include Nextcloud Desktop.
How do I fix CVE-2025-66549?
Upgrade to a fixed version.
Is CVE-2025-66549 being exploited?
There is no known exploitation of CVE-2025-66549 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2024-46958 Misconfiguration in n/a
- CVE-2020-8224 Code injection in Desktop Client
- CVE-2020-8225 Information disclosure in Desktop Client
- CVE-2021-37617 Untrusted Search Path in Nextcloud Desktop Client
- CVE-2023-28999 Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders
Sources
Also known as DEBIAN-CVE-2025-66549, GHSA-h9xj-qh76-q3hw, UBUNTU-CVE-2025-66549.