CVE-2025-66545
📋 TL;DR
This vulnerability in Nextcloud Groupfolders allows users with read-only permissions to restore files from the trash bin, bypassing intended access controls. It affects all Nextcloud instances with Groupfolders app installed before specific patched versions. This could lead to unauthorized file restoration and potential data integrity issues.
💻 Affected Systems
- Nextcloud Groupfolders app
📦 What is this software?
Group Folders by Nextcloud
Group Folders by Nextcloud
Group Folders by Nextcloud
Group Folders by Nextcloud
Group Folders by Nextcloud
Group Folders by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
A malicious user with read-only access could restore sensitive deleted files, potentially exposing confidential information or restoring malicious content that was intentionally removed.
Likely Case
Accidental or intentional restoration of deleted files by users who shouldn't have that capability, potentially causing data management issues or minor data leaks.
If Mitigated
With proper access controls and monitoring, impact is limited to minor data integrity issues within group folders.
🎯 Exploit Status
Exploitation requires authenticated user with read-only access to a group folder. The vulnerability is in the trash restoration functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, or 20.1.2 depending on your Nextcloud version
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vrq-fhmf-c49m
Restart Required: No
Instructions:
1. Update Nextcloud Groupfolders app via Nextcloud app store or command line. 2. For command line: sudo -u www-data php occ app:update groupfolders. 3. Verify update completed successfully.
🔧 Temporary Workarounds
Disable trash functionality
allTemporarily disable trash bin for group folders to prevent restoration attempts
Modify group folder permissions
allRemove read-only access from users who don't need it, or convert to write access where appropriate
🧯 If You Can't Patch
- Implement strict access controls and monitor group folder activity logs
- Educate users about proper file deletion procedures and risks of unauthorized restoration
🔍 How to Verify
Check if Vulnerable:
Check Groupfolders app version in Nextcloud admin settings. If version is below patched versions listed in affected_systems, you are vulnerable.Check Version:
sudo -u www-data php occ app:list | grep groupfoldersVerify Fix Applied:
After update, verify Groupfolders app version shows patched version. Test with a read-only user account that they cannot restore files from trash.📡 Detection & Monitoring
Log Indicators:
- Failed trash restoration attempts by read-only users
- Successful file restoration events from users with only read permissions
Network Indicators:
- API calls to trash restoration endpoints from unauthorized users
SIEM Query:
source="nextcloud.log" AND "restore" AND "trash" AND user_permission="read"