Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin
CVE-2025-66545

3.5LOW

Key Information:

Vendor

Nextcloud
Status
Security-advisories
Vendor
CVE Published:
5 December 2025

What is CVE-2025-66545?

Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash bin. This vulnerability is fixed in 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2.

Affected Version(s)

security-advisories < 14.0.11 < 14.0.11

security-advisories >= 15.0.0-beta1, < 15.3.12 < 15.0.0-beta1, 15.3.12

security-advisories >= 16.0.0, < 16.0.15 < 16.0.0, 16.0.15

References

https://github.com/nextcloud/security-advisories/security...
x_refsource_CONFIRM
https://github.com/nextcloud/groupfolders/issues/4041
x_refsource_MISC
https://github.com/nextcloud/groupfolders/pull/4076
x_refsource_MISC

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-66545 : Nextcloud Groupfolders - Vulnerability in Shared Folder File Management