CVE-2025-66550

Published: Dec 5, 2025Modified: Jun 17, 2026

5.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Exploitability: 2.1 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.

Affected (2)

Products: Nextcloud: Calendar

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Calendar	From 4.0.0 to 4.7.17
Nextcloud Calendar	From 5.0.0 to 5.2.4

Related CWEs

Improper Handling of Unexpected Data Type

The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).

References (4)

https://github.com/nextcloud/calendar/commit/63a6c398db01391eb9fd5297a0d4c3d6e614f769

Source: security-advisories@github.com

Patch

https://github.com/nextcloud/calendar/pull/6971

Source: security-advisories@github.com

Issue Tracking

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f29c-ppmv-8mcv

Source: security-advisories@github.com

PatchVendor Advisory

https://hackerone.com/reports/3112033

Source: security-advisories@github.com

Issue TrackingVendor Advisory

Timeline

No history available yet.