Nextcloud Deck app allows to spoof file extensions by using RTLO characters
Priority LOW 24CWE-116Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00165 5th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 1.15.1, 1.14.4, 1.12.7
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | 1.15.0-beta.1 to before 1.15.1; 1.14.0-beta.1 to before 1.14.4; before 1.12.7 | 1.15.1, 1.14.4, 1.12.7 | Patch available | CNA |
- security-advisories Vendornextcloud Affected 1.15.0-beta.1 to before 1.15.1; 1.14.0-beta.1 to before 1.14.4; before 1.12.7 Fixed in 1.15.1, 1.14.4, 1.12.7 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:* | before 1.12.7; 1.14.0 to before 1.14.4; 1.15.0 to before 1.15.1 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:* Versions before 1.12.7; 1.14.0 to before 1.14.4; 1.15.0 to before 1.15.1 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 1.15.1, 1.14.4, 1.12.7
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66548
References
More nextcloud Deck vulnerabilities
- TI-2023-08718 Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache CVSS 3.1MEDIUM 5.8
- TI-2022-11703 Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck CVSS 3.1MEDIUM 5.0
- TI-2022-08716 Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck CVSS 3.1MEDIUM 4.3
- TI-2021-16610 Missing permission check on Deck API CVSS 3.1HIGH 8.1
- TI-2020-06600 Improper access control in Nextcloud Deck CVSS 3.1HIGH 8.0
- TI-2021-05774 Information disclosure in Nextcloud Deck CVSS 3.1MEDIUM 6.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences