What is the CVSS score of EUVD-2025-201462?

EUVD-2025-201462 has a CVSS 3.1 base score of 2.4 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by EUVD-2025-201462?

CVE-2025-66549 is a low-severity vulnerability in Nextcloud Desktop (CVSS 2.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for…. A patch is available.

How to fix or mitigate EUVD-2025-201462?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

Ubuntu EUVD-2025-201462

| CVE-2025-66549 LOW

Error Message Information Leak (CWE-209)

2025-12-05 security-advisories@github.com

Information Disclosure Ubuntu Debian Nextcloud

2.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.4 LOW

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

Ubuntu

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201462

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

Patch released

Mar 15, 2026 - 17:08 nvd

Patch available

CVE Published

Dec 05, 2025 - 18:15 nvd

LOW 2.4

DescriptionGitHub Advisory

Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.

Analysis

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Error Message Information Leak (CWE-209).

RemediationAI

A vendor patch is available — apply it immediately. Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.

More in Nextcloud

View all

CVE-2023-26482 HIGH Act Now POC

8.8 Mar 30

Nextcloud server is an open source home cloud implementation. Rated high severity (CVSS 8.8), this vulnerability is remo

CVE-2020-8180 CRITICAL Act Now POC

9.9 Jun 08

A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk co

CVE-2023-48306 CRITICAL Act Now POC

9.8 Nov 21

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Rated critical severity (CVSS 9.8),

CVE-2016-9463 HIGH This Week POC

8.1 Mar 28

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authenti

CVE-2023-31128 HIGH This Week POC

8.8 May 26

NextCloud Cookbook is a recipe library app. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,

CVE-2023-28643 HIGH This Week POC

8.8 Mar 30

Nextcloud server is an open source home cloud implementation. Rated high severity (CVSS 8.8), this vulnerability is remo

CVE-2021-22879 HIGH This Week POC

8.8 Apr 14

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowi

CVE-2019-12739 HIGH This Week POC

8.8 Jun 05

lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution vi

CVE-2020-8259 HIGH This Week POC

8.1 Nov 16

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the

CVE-2020-8121 HIGH This Week POC

8.1 Feb 04

A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer. Rated high

CVE-2020-8182 HIGH This Week POC

8.0 Oct 05

Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permiss

CVE-2020-8224 HIGH This Week POC

7.8 Aug 10

A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL confi

Same weakness CWE-209 – Error Message Information Leak

View all

CVE-2025-47813 MEDIUM POC

4.3

CVE-2017-7551 CRITICAL POC

9.8

CVE-2026-48039 CRITICAL POC

9.1

CVE-2022-31140 CRITICAL POC

9.1

CVE-2024-23689 HIGH POC

8.8

CVE-2018-17961 HIGH POC

8.6

CVE-2023-37306 HIGH POC

7.5

CVE-2026-29146 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

Ubuntu

Priority: Medium

nextcloud-desktop

Release	Status	Version
focal	needs-triage	-
jammy	needs-triage	-
noble	needs-triage	-
questing	not-affected	3.16.6-3
upstream	released	3.16.6-3
plucky	ignored	end of life, was needs-triage

Debian

nextcloud-desktop

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	3.1.1-2+deb11u1	-
bullseye (security)	vulnerable	3.1.1-2+deb11u2	-
bookworm	vulnerable	3.7.3-1+deb12u2	-
trixie	fixed	3.16.7-1~deb13u1	-
forky, sid	fixed	4.0.6-1	-
(unstable)	fixed	3.16.6-3	-

EUVD-2025-201462 vulnerability details – vuln.today

Back

Ubuntu EUVD-2025-201462

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

Analysis

Technical ContextAI

RemediationAI

More in Nextcloud

Same weakness CWE-209 – Error Message Information Leak

Same technique Information Disclosure

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code