CVE-2025-66547

MEDIUM

Nextcloud Server <31.0.1 - Info Disclosure

Title source: llm

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.

References (5)

Scores

CVSS v3 4.3
EPSS 0.0002
EPSS Percentile 4.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Classification

CWE
CWE-639
Status published

Affected Products (2)

nextcloud/nextcloud_server < 31.0.1
nextcloud/nextcloud_server < 31.0.1

Timeline

Published Dec 05, 2025
Tracked Since Feb 18, 2026