CVE-2025-66548

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66548
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66548.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66548
Aliases
  • GHSA-xjvq-xvr7-xpg6
Published
2025-12-05T17:26:11.306Z
Modified
2026-02-07T02:52:56.234456Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Nextcloud Deck app allows to spoof file extensions by using RTLO characters
Details

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.

Database specific 
{
    "cwe_ids": [
        "CWE-116"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66548.json"
}
References

Affected packages

Git / github.com/nextcloud/deck

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/deck
Events
Introduced
a552bde7c7270d56760cb980b5f24ee9f0526a4c
Fixed
3e69070e8c01e7bbb477f43e3dfecc9d2be6c3e2
Database specific 
{
    "versions": [
        {
            "introduced": "1.15.0-beta.1"
        },
        {
            "fixed": "1.15.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/deck
Events
Introduced
f21282c5d62e888429a1e375dd599551399ca864
Fixed
a4e40ec11e70d3803aa8c20c58bcfa3ee2eabde4
Database specific 
{
    "versions": [
        {
            "introduced": "1.14.0-beta.1"
        },
        {
            "fixed": "1.14.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/deck
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
781fe1f2bc97c37c9d268703ebcf482f8bc726ea
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.12.7"
        }
    ]
}

Affected versions

v1.*
v1.14.0
v1.14.0-beta.1
v1.14.0-beta.2
v1.14.1
v1.14.2
v1.14.3
v1.15.0
v1.15.0-beta.1
v1.15.0-beta.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66548.json"