CVE-2025-66549
📋 TL;DR
Nextcloud Desktop client versions before 3.16.5 send file paths unencrypted to the server when manually locking files in end-to-end encrypted directories. This allows server administrators to see which files users are accessing in their encrypted folders through server logs. Only affects users of Nextcloud Desktop client with end-to-end encrypted directories.
💻 Affected Systems
- Nextcloud Desktop
📦 What is this software?
Desktop by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
Server administrators could map user activity patterns, identify sensitive files by path names, and potentially correlate encrypted content with specific files.
Likely Case
Server administrators gain visibility into which encrypted files users are accessing, compromising privacy expectations of end-to-end encryption.
If Mitigated
With proper access controls, only trusted administrators would see the paths, but privacy expectations of end-to-end encryption would still be violated.
🎯 Exploit Status
Exploitation requires server administrator access to view logs. The vulnerability is inherent in the client's behavior when locking files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.16.5
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h9xj-qh76-q3hw
Restart Required: Yes
Instructions:
1. Open Nextcloud Desktop client. 2. Go to Settings > General. 3. Check for updates or manually update to version 3.16.5. 4. Restart the client after update.
🔧 Temporary Workarounds
Avoid manual file locking in encrypted directories
allDo not manually lock files within end-to-end encrypted directories until patched.
🧯 If You Can't Patch
- Disable end-to-end encrypted directories feature temporarily
- Implement strict access controls on server logs to limit administrator access
🔍 How to Verify
Check if Vulnerable:
Check Nextcloud Desktop client version in Settings > General. If version is below 3.16.5 and you use end-to-end encrypted directories, you are vulnerable.Check Version:
On Linux: nextcloud --version; On Windows/macOS: Check in client UI under Settings > GeneralVerify Fix Applied:
Verify client version is 3.16.5 or higher in Settings > General. Test manual file locking in encrypted directory and confirm no unencrypted path transmission in server logs.📡 Detection & Monitoring
Log Indicators:
- Server logs showing file paths from encrypted directories during manual lock operations
Network Indicators:
- Unencrypted file path transmissions in client-server communications
SIEM Query:
source="nextcloud_server" AND (message="file_lock" OR message="manual_lock") AND path CONTAINS "/e2e/"