Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash bin. This vulnerability is fixed in 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2.
References
| Link | Resource |
|---|---|
| https://github.com/nextcloud/groupfolders/commit/bbe87ebed8da23e9df4db637a76fbc8d36439d58 | Patch |
| https://github.com/nextcloud/groupfolders/issues/4041 | Issue Tracking |
| https://github.com/nextcloud/groupfolders/pull/4076 | Issue Tracking Patch |
| https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vrq-fhmf-c49m | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
09 Dec 2025, 19:10
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Nextcloud
Nextcloud group Folders |
|
| References | () https://github.com/nextcloud/groupfolders/commit/bbe87ebed8da23e9df4db637a76fbc8d36439d58 - Patch | |
| References | () https://github.com/nextcloud/groupfolders/issues/4041 - Issue Tracking | |
| References | () https://github.com/nextcloud/groupfolders/pull/4076 - Issue Tracking, Patch | |
| References | () https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vrq-fhmf-c49m - Patch, Vendor Advisory | |
| CPE | cpe:2.3:a:nextcloud:group_folders:*:*:*:*:*:*:*:* |
05 Dec 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-05 18:15
Updated : 2025-12-09 19:10
NVD link : CVE-2025-66545
Mitre link : CVE-2025-66545
CVE.ORG link : CVE-2025-66545
JSON object : View
Products Affected
nextcloud
- group_folders
CWE
CWE-707
Improper Neutralization