CVE-2025-66549EPSS p20.9%

CVE-2025-66549CVE-2025-66549

nextcloud / desktop

Description

Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.

Scoring

CVSS 2.4 ()
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
EPSS0.30% probability of exploitation · percentile 20.9% · 2026-10-17T12:00:28Z
Last modified2026-10-15
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.