Nextcloud Group Folders vulnerabilities

3 CVEs affecting Nextcloud Group Folders, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-66545, published 2025-12-05.

More from Nextcloud.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-8153, published 2020-05-12. High severity, CVSS 8.1. EPSS: 1.9% chance of exploitation in the next 30 days. Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same name.
• CVE-2025-47793, published 2025-05-16. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to…
• CVE-2025-66545, published 2025-12-05. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only…