CVE-2025-66548: Nextcloud Deck File Extension Spoofing

CVE-2025-66548 Overview

CVE-2025-66548 affects Nextcloud Deck, a kanban-style project organization tool integrated with the Nextcloud platform. The vulnerability allows attackers to spoof file extensions by embedding Right-to-Left Override (RTLO) Unicode characters in attachment filenames. Users viewing attachments in the Deck interface see a filename with a different extension than the actual file they will download. This user interface confusion can trick users into executing malicious files disguised as benign document types. The flaw is categorized under [CWE-116] Improper Encoding or Escaping of Output. Nextcloud addressed the issue in Deck versions 1.12.7, 1.14.4, and 1.15.1.

Critical Impact
Attackers can disguise executable or scripted attachments as harmless document types, increasing the likelihood that users download and open malicious files from shared boards.

Affected Products

Nextcloud Deck versions prior to 1.12.7
Nextcloud Deck 1.14.x versions prior to 1.14.4
Nextcloud Deck 1.15.x versions prior to 1.15.1

Discovery Timeline

2025-12-05 - CVE-2025-66548 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66548

Vulnerability Analysis

The vulnerability resides in the attachment rendering logic of Nextcloud Deck. The application displayed the raw attachment name using a single basename span in AttachmentList.vue, without separating the filename from its actual extension. When an attacker uploaded a file containing a Right-to-Left Override character (U+202E) in its name, the browser reversed the display order of characters following the RTLO marker. A file named invoice\\u202Efdp.exe renders visually as invoiceexe.pdf, while the underlying file remains an executable. Because Deck rendered the untrusted filename directly, users had no visual signal that the displayed extension differed from the true file type on disk.

Root Cause

The root cause is improper output encoding [CWE-116]. Deck rendered attachment names verbatim without normalizing bidirectional Unicode control characters or splitting the filename from the trusted extension component. The patch introduces explicit separation between the basename and extension in the DOM, sourcing the extension from server-side metadata rather than the raw filename string.

Attack Vector

Exploitation requires an attacker with permissions to upload attachments to a Deck card, and requires a victim to click the deceptive attachment. The attack vector is local to the Nextcloud instance and depends on user interaction. Impact is limited to confidentiality risk as users download files they did not intend to open.

javascript

// Patch: src/components/card/AttachmentList.vue
// Before (vulnerable):
// <span class="basename">{{ attachment.name }}</span>
// After (fixed):
<span>{{ attachmentBasename(attachment) }}</span>
<span class="extension">.{{ attachmentExtension(attachment) }}</span>

Source: Nextcloud Deck commit afa95d3

The corresponding Cypress test update confirms the fix separates filename and extension in the rendered DOM:

javascript

// cypress/e2e/cardFeatures.js
cy.get('.attachment-list .filename').contains('welcome')
cy.get('.attachment-list .filename .extension').contains('txt')

Source: Nextcloud Deck commit afa95d3

Detection Methods for CVE-2025-66548

Indicators of Compromise

Attachment filenames in Deck containing Unicode character U+202E (RTLO), U+202D (LRO), or other bidirectional control characters
Deck attachments whose stored file extension does not match the displayed extension in audit logs
Uploaded files with double extensions such as .pdf.exe combined with bidirectional overrides

Detection Strategies

Scan Nextcloud attachment storage for filenames containing bidirectional Unicode control characters using regex matching on codepoints U+202A-U+202E and U+2066-U+2069
Review Deck audit logs for attachment uploads by users with a history of suspicious activity or accounts created recently
Correlate download events with endpoint telemetry to identify cases where a user downloaded an executable after viewing what appeared to be a document

Monitoring Recommendations

Enable Nextcloud audit logging (admin_audit app) and forward events to a centralized log platform for filename inspection
Alert on downloads of executable file types (.exe, .scr, .js, .bat, .hta) sourced from Deck attachments
Monitor endpoint process creation events where the parent process is a browser and the child image was recently downloaded from the Nextcloud domain

How to Mitigate CVE-2025-66548

Immediate Actions Required

Upgrade Nextcloud Deck to version 1.12.7, 1.14.4, or 1.15.1 depending on the deployed release branch
Audit existing Deck attachments for filenames containing bidirectional Unicode control characters and remove or rename offending files
Communicate to end users that attachment filenames may have been visually misleading prior to the patch

Patch Information

The fix is available in Nextcloud Deck versions 1.12.7, 1.14.4, and 1.15.1. The code change is committed in Nextcloud Deck commit afa95d3 and documented in GitHub Security Advisory GHSA-xjvq-xvr7-xpg6. Additional context is available in HackerOne Report #2326618.

Workarounds

Restrict Deck attachment upload permissions to trusted users until the patch is applied
Implement server-side filename sanitization at the reverse proxy or WAF layer to strip bidirectional Unicode control characters
Instruct users to verify file extensions by inspecting the download prompt or downloaded file properties before opening

bash

# Upgrade Nextcloud Deck via occ command
sudo -u www-data php /var/www/nextcloud/occ app:update deck

# Verify installed version
sudo -u www-data php /var/www/nextcloud/occ app:list | grep -A1 deck

# Search attachment directory for RTLO characters in filenames
find /var/www/nextcloud/data -type f -name '*'$'\\u202E''*'