Medium severity4.3NVD Advisory· Published Dec 5, 2025· Updated Jun 17, 2026

CVE-2025-66547

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nextcloud/Nextcloud Enterprise Serverllm-fuzzy
Range: <31.0.1
osv-coords2 versions
pkg:bitnami/nextcloud pkg:apk/chainguard/nextcloud-server-30-apache2-config
< 31.0.1+ 1 more
- (no CPE)range: < 31.0.1
- (no CPE)range: < 30.0.17-r0
Nextcloud/Server2 versions
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*+ 1 more
- cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*range: >=31.0.0,<31.0.1
- cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*range: >=31.0.0,<31.0.1
Nextcloud/security-advisoriescpe-rescue
Range: < 31.0.1

Patches

Vulnerability mechanics

References

github.com/nextcloud/security-advisories/security/advisories/GHSA-hq6c-r898-fgf2nvdPatchVendor Advisory
github.com/nextcloud/server/commit/b44f1568f2dc97c746281d99e2342ad679e3d8a9nvdPatch
hackerone.com/reports/3040887nvdPermissions RequiredVendor Advisory
github.com/nextcloud/server/issues/51247nvdIssue Tracking
github.com/nextcloud/server/pull/51288nvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000