CVE-2025-66548
📋 TL;DR
This vulnerability in Nextcloud Deck allows attackers to spoof file extensions using Right-to-Left Override (RTLO) characters, tricking users into downloading files with different extensions than displayed. Users of Nextcloud Deck versions before 1.12.7, 1.14.4, and 1.15.1 are affected when downloading files from the Deck application.
💻 Affected Systems
- Nextcloud Deck
📦 What is this software?
Deck by Nextcloud
Deck by Nextcloud
Deck by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
Users download malicious executables disguised as benign documents, leading to malware infection, data theft, or system compromise.
Likely Case
Users download files with unexpected extensions, potentially executing malicious scripts or opening dangerous file types.
If Mitigated
Users are warned about suspicious file extensions or downloads are blocked by security software.
🎯 Exploit Status
Exploit requires user to download a file. Proof of concept available in HackerOne report #2326618.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.12.7, 1.14.4, or 1.15.1
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xjvq-xvr7-xpg6
Restart Required: No
Instructions:
1. Update Nextcloud Deck to version 1.12.7, 1.14.4, or 1.15.1 via Nextcloud app store or manual installation. 2. Clear Nextcloud cache if issues persist.
🔧 Temporary Workarounds
Disable file downloads from Deck
allTemporarily disable file attachment/download functionality in Deck until patched.
User education
allWarn users about suspicious file downloads and verify file extensions before opening.
🧯 If You Can't Patch
- Implement web application firewall rules to block RTLO characters in file names
- Configure endpoint protection to scan all downloads from Nextcloud for malicious content
🔍 How to Verify
Check if Vulnerable:
Check Nextcloud Deck version in Nextcloud admin settings under 'Apps' > 'Deck'.Check Version:
Check Nextcloud admin interface or run: php occ app:list | grep deckVerify Fix Applied:
Verify Deck version is 1.12.7, 1.14.4, or 1.15.1 or higher in Nextcloud admin settings.📡 Detection & Monitoring
Log Indicators:
- Unusual file download patterns from Deck
- Files with RTLO characters in names
Network Indicators:
- File downloads from Deck with unusual extensions
SIEM Query:
source="nextcloud" AND (event="file_download" OR event="deck_attachment") AND filename MATCHES "\\u202E"