CVE-2025-66545: Nextcloud Group Folders

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash bin. This vulnerability is fixed in 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2.

Affected products

• Nextcloud Group Folders: before 14.0.11 (fixed in 14.0.11); from 15.0.0, before 15.3.12 (fixed in 15.3.12); from 16.0.0, before 16.0.15 (fixed in 16.0.15); from 17.0.0, before 17.0.14 (fixed in 17.0.14); from 18.0.0, before 18.1.8 (fixed in 18.1.8); from 19.0.0, before 20.1.2 (fixed in 20.1.2)

Published 2025-12-05. Last modified 2026-06-17.