CVE-2025-66514

MEDIUM EPSS 10.4%
Published Dec 5, 20257mo ago · Modified Jun 17, 20262w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Dec 5, 2025 7mo ago
Last Modified Jun 17, 2026 2w ago

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.

CVSS Details

Base Score
5.4
Exploitability
2.3
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
10.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
nextcloudmail* <5.5.3

References 4

  • github.com https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09
    Patch
  • github.com https://github.com/nextcloud/mail/pull/11740
    Issue TrackingPatch
  • github.com https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5
    PatchVendor Advisory
  • hackerone.com https://hackerone.com/reports/3357036
    Permissions RequiredVendor Advisory

Remediation

  • github.com https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09
    Patch
  • github.com https://github.com/nextcloud/mail/pull/11740
    Issue TrackingPatch
  • github.com https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5
    PatchVendor Advisory