CVE-2025-66550 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that lin…
Medium CVSS: 5.7

CVE-2025-66550

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.
Vendor
Nextcloud
Product
Calendar
CWE
CWE-241
Yayın Tarihi
2025-12-05 17:16:05
Güncelleme
2025-12-10 14:13:30
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-241 Calendar MEDIUM Nextcloud 2025

Referanslar

https://github.com/nextcloud/calendar/commit/63a6c398db01391eb9fd5297a0d4c3d6e614f769 https://github.com/nextcloud/calendar/pull/6971 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f29c-ppmv-8mcv https://hackerone.com/reports/3112033