CVE-2025-66550: Nextcloud Calendar CSRF Vulnerability

CVE-2025-66550 Overview

CVE-2025-66550 is a medium-severity vulnerability in Nextcloud Calendar, the calendar application for the Nextcloud collaboration platform. A malicious user can craft a calendar event containing an attachment that points to a download link on the same Nextcloud server. When another user interacts with the attachment, the file downloads without a confirmation prompt. The flaw is categorized under [CWE-241] (Improper Handling of Unexpected Data Type) and affects Nextcloud Calendar versions prior to 4.7.17 and 5.2.4. Both branches receive patched releases.

Critical Impact
Authenticated attackers can trigger automatic downloads of attacker-controlled files hosted on the same Nextcloud instance, enabling social-engineering attacks against calendar users.

Affected Products

Nextcloud Calendar versions prior to 4.7.17
Nextcloud Calendar versions prior to 5.2.4
Nextcloud server deployments running the vulnerable Calendar app

Discovery Timeline

2025-12-05 - CVE-2025-66550 published to the National Vulnerability Database
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-66550

Vulnerability Analysis

The vulnerability resides in the attachment handling logic of the Nextcloud Calendar editor component, specifically in src/components/Editor/Attachments/AttachmentsList.vue. When a user clicks an attachment linked from a calendar event, the client evaluates whether the destination URL belongs to the same Nextcloud instance. If the hostname matches the local Nextcloud base URL, the code treats the link as trusted and opens it directly through window.open() without warning the user.

An attacker who can create or share a calendar event can craft an attachment whose target URL points to a /download endpoint on the same server. Because the hostname check succeeds, the file is retrieved immediately when the attachment is clicked. The user has no opportunity to inspect the file name or origin before the download begins.

Root Cause

The root cause is incomplete trust validation. Same-origin URLs were considered inherently safe, but Nextcloud exposes direct file download endpoints under its own hostname. An attacker-controlled file uploaded to the server shares the trusted origin, so the client bypassed the confirmation dialog that applied to external URLs.

Attack Vector

Exploitation requires an authenticated attacker with permission to create calendar events and share them, plus user interaction from the victim clicking the attachment. The attack chain supports phishing-style delivery of malicious files such as scripts, HTML smuggling payloads, or disguised executables that appear to originate from a trusted Nextcloud location.

text

// Patch excerpt from src/components/Editor/Attachments/AttachmentsList.vue
const baseUrl = new URL(getBaseUrl())
if (url.href.startsWith(baseUrl.href)) {
+    if (url.pathname.endsWith('/download') || url.pathname.endsWith('/download/')) {
+        // Show a confirmation to warn users of direct downloads
+        this.showConfirmationDialog(
+            t('calendar', 'You are about to download a file. Please check the file name before opening it. Are you sure to proceed?'),
+            url,
+        )
+        return
+    }
    // URL belongs to this instance and is safe
    window.open(url.href, '_blank', 'noopener noreferrer')
    return
}

Source: Nextcloud Calendar commit 63a6c398

Detection Methods for CVE-2025-66550

Indicators of Compromise

Calendar events containing attachment URLs that end with /download or /download/ on the local Nextcloud host
Unexpected file download activity from the Nextcloud web client immediately after calendar event interaction
Calendar .ics entries with ATTACH properties referencing internal file paths uploaded by low-privilege users

Detection Strategies

Review Nextcloud application logs for file download requests correlated with calendar event access by the same session
Query the Nextcloud database for calendar objects whose attachment URIs reference the local server's /download endpoints
Inspect uploaded files owned by users who also create shared calendar events, prioritizing executables, scripts, and HTML files

Monitoring Recommendations

Enable verbose logging on the Nextcloud files and dav apps to capture attachment access patterns
Alert on calendar invitations shared broadly across the tenant that include attachment metadata pointing to local download URLs
Monitor web proxy and endpoint telemetry for file retrievals initiated from the Nextcloud Calendar interface

How to Mitigate CVE-2025-66550

Immediate Actions Required

Upgrade Nextcloud Calendar to version 4.7.17 or 5.2.4 as soon as possible
Audit user-created calendar events for attachments referencing same-origin /download URLs
Communicate the risk to users and instruct them to verify attachment file names before opening

Patch Information

The fix is applied in Nextcloud Calendar 4.7.17 and 5.2.4. The patch adds an explicit confirmation dialog whenever an attachment URL points to a /download endpoint on the local Nextcloud instance, matching the behavior already enforced for external links. Full details are available in the GitHub Security Advisory GHSA-f29c-ppmv-8mcv and the corresponding GitHub Pull Request #6971.

Workarounds

Restrict calendar event creation and sharing permissions to trusted user groups until patching is complete
Disable the Nextcloud Calendar app in environments where immediate patching is not feasible
Enforce file-type restrictions on Nextcloud uploads to reduce the impact of malicious attachments

bash

# Upgrade Nextcloud Calendar via occ to the fixed release
sudo -u www-data php occ app:update calendar
sudo -u www-data php occ app:list | grep calendar
# Verify installed version is >= 4.7.17 or >= 5.2.4