CVE-2025-66548: 
NixOS vulnerability analysis and mitigation

CVE-2025-66548 is a file extension spoofing vulnerability in Nextcloud Deck, a kanban-style project organization app integrated with Nextcloud. By embedding Right-to-Left Override (RTLO) Unicode characters in filenames, an attacker can cause the displayed file extension to differ from the actual extension, tricking users into downloading or opening files they believe are safe. The vulnerability affects Nextcloud Deck versions prior to 1.12.7, 1.14.0–1.14.3, and 1.15.0. It was published on December 5, 2025, with patches released shortly after. The CVSS v3.1 base score is 5.5 (Medium) per NVD, while the GitHub Security Advisory rates it 3.3 (Low) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-116 (Improper Encoding or Escaping of Output): the Deck app rendered attachment filenames directly in the DOM without stripping or escaping RTLO characters (Unicode U+202E), allowing the visual display of a filename to be reversed. For example, a file named malware[U+202E]txt.exe could appear to users as malwareexe.txt, masking the true .exe extension. The fix, implemented in pull request #6671, separates the filename basename and extension into distinct DOM elements and explicitly strips RTLO characters before rendering or inserting filenames into card descriptions (GitHub Advisory, GitHub Commit).

Successful exploitation allows an attacker to deceive Nextcloud Deck users into believing a malicious file has a benign extension (e.g., displaying .txt when the actual extension is .exe or .sh), potentially leading to execution of malicious code if the user opens the downloaded file. The confidentiality impact is rated High by NVD (users may be misled into exposing themselves to malware), while integrity and availability impacts are None. The attack is local in scope and requires user interaction, limiting its reach to users who actively download and open the spoofed attachment (GitHub Advisory, Red Hat CVE).

No public exploit code or in-the-wild exploitation has been reported for CVE-2025-66548. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to upload a crafted file with RTLO characters in its name to a Nextcloud Deck board and then socially engineer a victim into downloading and executing it (GitHub Advisory).

1. Craft a malicious filename: Create a file whose name embeds the RTLO Unicode character (U+202E) to reverse the displayed extension — for example, name the file malware‮txt.exe so it visually appears as malwareexe.txt in the Deck UI.
2. Upload to Nextcloud Deck: Attach the crafted file to a card on a shared Nextcloud Deck board accessible to the target user.
3. Social engineering: Persuade the target user to download the attachment, relying on the spoofed extension display to make the file appear safe (e.g., a text document).
4. Victim executes the file: The user opens what they believe is a .txt file; the operating system executes it as an .exe or other executable, potentially compromising the victim's system (GitHub Advisory, GitHub Commit).

• File System: Files downloaded from Nextcloud Deck with names containing the RTLO character (U+202E); files whose displayed extension differs from the actual file extension as reported by the OS or antivirus.
• Logs: Nextcloud server-side file upload logs showing filenames with bidirectional Unicode control characters (U+202E) in attachment names.
• Network: Unusual file downloads from Nextcloud Deck boards, particularly executables or scripts disguised with spoofed extensions.

Nextcloud has released patched versions of the Deck app: 1.12.7, 1.14.4, and 1.15.1. Administrators should upgrade to one of these versions immediately. As a temporary workaround, the official advisory recommends disabling the Deck app entirely until the upgrade can be applied. No additional configuration-based mitigations are available (GitHub Advisory).