Nextcloud Deck CVE-2025-66548

Exploitation requires an authenticated attacker with write access to a shared Nextcloud Deck board who can add a card attachment, and whose filename contains a Unicode right-to-left-override character (U+202E) to reverse the apparent extension. A second user must then view the card and actively choose to download the attachment, being misled about its true file type. Limiting factors: attacker needs board membership (not anonymous), the victim must perform user interaction (download and, for real harm, execute the file), and only Deck versions before 1.12.7, 1.14.4, and 1.15.1 are affected - patched instances strip RTLO and render the extension separately.

This is a medium-severity (CVSS 5.5) UI spoofing flaw and the combined signals point to LOW real-world urgency rather than a priority threat. EPSS is 0.01% (1st percentile), there is no CISA KEV listing, and no public exploit code was identified - only a private HackerOne report (#2326618) and the vendor fix. The CVSS vector itself is internally questionable: it is scored AV:L/AC:L/PR:N/UI:R with C:H/I:N/A:N, yet the vulnerability is a right-to-left-override (RTLO) filename spoof whose real effect is deceiving a user into downloading/executing a mislabeled file - an integrity/deception concern, not high confidentiality loss, so the C:H rating appears generous. The AV:L (local) choice also conflicts with the delivery model: the malicious attachment is actually delivered over the web to a shared Deck board, which argues for AV:N - verify attack-vector framing with the vendor advisory. PR:N is also debatable because adding a card attachment requires authenticated board membership. Net: a legitimate issue worth patching, but the low EPSS, absence of KEV/POC, and the requirement for both attacker board access and victim interaction make it a low-priority, non-widespread risk.

An attacker who is a member of a shared Deck board uploads a card attachment whose filename embeds an RTLO (U+202E) character, so the Deck UI renders it as, for example, 'invoicetxt.exe' appearing as 'invoiceexe.txt'. A collaborating user views the card, believes the file is a harmless text document, downloads it, and may execute a malicious binary. Exploitation requires user interaction (UI:R) and no public exploit code was identified at time of analysis.