CVE-2025-66548
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In Nextcloud Deck prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into downloading files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.
Risk Assessment
An attacker can deliver a file that appears harmless but actually has a different extension, potentially leading to execution of malicious software. The risk affects users downloading files from Deck boards.
Recommendation
Update the Nextcloud Deck app to version 1.12.7, 1.14.4, or 1.15.1 (or later). It is also advisable to warn users about downloading files from unknown sources.
Other vulnerabilities in Nextcloud Deck
Original NVD description (English source)
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS