CVE-2025-66552
Nextcloud Server admin_audit does not log all actions on files in groupfolders
Summary
Nextcloud Server admin_audit does not log all actions on files in groupfolders
Original description
The description as published by the source.
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
nextcloud
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"31.0.9"},{"introduced":"32.0.0"},{"fixed":"32.0.1"}]}]
References
- advisory github.com
- advisory hackerone.com
- patch github.com
- report github.com
- web nvd.nist.gov