CVE Vulnerabilities

CVE-2025-66552

Insufficient Logging

Published: Dec 05, 2025 | Modified: Dec 10, 2025
CVSS 3.x
4.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.

Weakness

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Affected Software

Name Vendor Start Version End Version
Nextcloud_server Nextcloud 30.0.0 (including) 30.0.9 (excluding)
Nextcloud_server Nextcloud 31.0.0 (including) 31.0.1 (excluding)

Extended Description

When security-critical events are not logged properly, such as a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analysis after an attack succeeds. As organizations adopt cloud storage resources, these technologies often require configuration changes to enable detailed logging information, since detailed logging can incur additional costs. This could lead to telemetry gaps in critical audit logs. For example, in Azure, the default value for logging is disabled.

Potential Mitigations

References