CVE-2025-66550
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Nextcloud Calendar before versions 4.7.17 and 5.2.4 allows a malicious user to create a calendar event with a crafted attachment linking to a file download on the same Nextcloud server. The file is downloaded without the user confirming the action.
Risk Assessment
An attacker can trick a user into unknowingly downloading files from the server, potentially leading to data exposure or further attacks. This affects organizations using vulnerable versions of Nextcloud Calendar.
Recommendation
Update Nextcloud Calendar to version 4.7.17 or 5.2.4 (or later). Verify that users do not have vulnerable versions installed.
Other vulnerabilities in Nextcloud Calendar
See all- CVE-2025-66546Low
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a sequential ID without knowing the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.
- CVE-2025-66511Medium
Nextcloud Calendar prior to 6.0.3 generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens. This allowed them to request details and submit dates in meeting proposals. The tokens are not purely randomly generated.
Original NVD description (English source)
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS