CVE-2025-50735: Nextchat

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints.

Affected products

• Nextchat Nextchat: up to and including 2.16.0

Published 2025-11-03. Last modified 2026-06-17.