Medium severity5.7NVD Advisory· Published Dec 5, 2025· Updated Oct 18, 2026

CVE-2025-66550

Description

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nextcloud/security-advisoriescpe-rescue
Range: >= 5.0.0-rc.1, < 5.2.4
Nextcloud/Calendarllm-fuzzy2 versions
<4.7.17 and <5.2.4+ 1 more
- (no CPE)range: <4.7.17 and <5.2.4
- cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*range: >=4.0.0,<4.7.17

Patches

Vulnerability mechanics

References

github.com/nextcloud/calendar/commit/63a6c398db01391eb9fd5297a0d4c3d6e614f769nvdPatch
github.com/nextcloud/security-advisories/security/advisories/GHSA-f29c-ppmv-8mcvnvdPatchVendor Advisory
hackerone.com/reports/3112033nvdIssue TrackingVendor Advisory
github.com/nextcloud/calendar/pull/6971nvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.371
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000