CVE-2025-66550
📋 TL;DR
This vulnerability in Nextcloud Calendar allows a malicious user to create calendar events with crafted attachments that automatically download files from the same Nextcloud server without user confirmation. This affects Nextcloud Calendar versions prior to 4.7.17 and 5.2.4, potentially exposing sensitive files to unauthorized users.
💻 Affected Systems
- Nextcloud Calendar
📦 What is this software?
Calendar by Nextcloud
Calendar by Nextcloud
⚠️ Risk & Real-World Impact
Worst Case
An attacker could exfiltrate sensitive files from the Nextcloud server, including confidential documents, user data, or configuration files containing credentials.
Likely Case
Unauthorized access to files that should be protected, potentially exposing internal documents or user-uploaded content.
If Mitigated
Limited impact with proper access controls and file permissions, but still represents a violation of expected user consent for downloads.
🎯 Exploit Status
Exploitation requires authenticated access to create calendar events. The vulnerability is straightforward to exploit once an attacker has valid credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.7.17 or 5.2.4
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f29c-ppmv-8mcv
Restart Required: No
Instructions:
1. Update Nextcloud Calendar app to version 4.7.17 or 5.2.4 via Nextcloud's app management interface. 2. Alternatively, update through command line: sudo -u www-data php occ app:update calendar. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable Calendar App
linuxTemporarily disable the Calendar app to prevent exploitation while planning the update.
sudo -u www-data php occ app:disable calendar
Restrict Calendar Creation
allLimit calendar event creation to trusted users only through Nextcloud permissions.
🧯 If You Can't Patch
- Implement strict access controls on sensitive files and directories
- Monitor calendar event creation logs for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Calendar app version in Nextcloud admin interface or run: sudo -u www-data php occ app:list | grep calendarCheck Version:
sudo -u www-data php occ app:list | grep calendarVerify Fix Applied:
Confirm Calendar app version is 4.7.17 or higher (for version 4.x) or 5.2.4 or higher (for version 5.x)📡 Detection & Monitoring
Log Indicators:
- Unusual calendar event creation patterns
- Multiple file downloads triggered from calendar attachments
- Failed attempts to access restricted files via calendar links
Network Indicators:
- Unexpected file download requests originating from calendar endpoints
SIEM Query:
source="nextcloud.log" AND ("calendar" AND "download" AND "attachment")