{"id":"CVE-2025-66548","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-66548","generatedAt":"2026-10-28T02:11:09.980Z","title":"This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.","description":"Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.","published":"2025-12-05T18:15:58.000Z","lastModified":"2026-10-15T21:10:00.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},"cwe":["CWE-116"],"affected":["nextcloud/deck"],"epss":{"score":0.00154,"percentile":0.04468,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/nextcloud/deck/commit/afa95d3c507465b9d31af7c88c69b76711ef185a","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/nextcloud/deck/pull/6671","tags":["Issue Tracking"],"source":"security-advisories@github.com"},{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xjvq-xvr7-xpg6","tags":["Patch","Vendor Advisory"],"source":"security-advisories@github.com"},{"url":"https://hackerone.com/reports/2326618","tags":["Permissions Required","Vendor Advisory"],"source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-66548","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}