File Extension Spoofing Vulnerability in Nextcloud Deck by Nextcloud
CVE-2025-66548

3.3LOW

Key Information:

Vendor

Nextcloud
Status
Security-advisories
Vendor
CVE Published:
5 December 2025

What is CVE-2025-66548?

Nextcloud Deck, a kanban-style organizational tool, is susceptible to a file extension spoofing vulnerability due to improper handling of right-to-left override (RTLO) characters. This flaw can mislead users into downloading files with deceptive extensions, potentially leading to unintended file execution. This critical issue has been addressed in versions 1.12.7, 1.14.4, and 1.15.1, improving the application's security posture.

Affected Version(s)

security-advisories >= 1.15.0-beta.1, < 1.15.1 < 1.15.0-beta.1, 1.15.1

security-advisories >= 1.14.0-beta.1, < 1.14.4 < 1.14.0-beta.1, 1.14.4

security-advisories < 1.12.7 < 1.12.7

References

https://github.com/nextcloud/security-advisories/security...
x_refsource_CONFIRM
https://github.com/nextcloud/deck/pull/6671
x_refsource_MISC
https://github.com/nextcloud/deck/commit/afa95d3c507465b9...
x_refsource_MISC

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-66548 : File Extension Spoofing Vulnerability in Nextcloud Deck by Nextcloud