UpHeron
All vulnerabilities

Servers and applications

CVE-2025-66552

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.

Severity
Medium 4.3
Published
5 Dec 2025
Last changed
18 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
30.0.9, 31.0.1
Sources
NVD

Affected software

SoftwareAffected versions
NextcloudServers and applications · cpe:a:nextcloud:nextcloud_server
  • From 30.0.0 before 30.0.9
  • From 31.0.0 before 31.0.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-66552
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-66552