CVE-2025-66514

Published: Dec 5, 2025Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.

Affected (1)

Products: Nextcloud: Mail

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Mail	Before 5.5.3

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09

Source: security-advisories@github.com

Patch

https://github.com/nextcloud/mail/pull/11740

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5

Source: security-advisories@github.com

PatchVendor Advisory

https://hackerone.com/reports/3357036

Source: security-advisories@github.com

Permissions RequiredVendor Advisory

Timeline

No history available yet.