CVE-2025-66550

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.

CVSS 3.1

5.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-25)

CWE

CWE-241

Published

2025-12-05

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• nextcloud:calendar

References

• https://github.com/nextcloud/calendar/commit/63a6c398db01391eb9fd5297a0d4c3d6e614f769
• https://github.com/nextcloud/calendar/pull/6971
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f29c-ppmv-8mcv
• https://hackerone.com/reports/3112033

Check your stackJSON