Vulnerability · Published Dec 5, 2025 · Assigned by GitHub_M
CVE-2025-66514Nextcloud Mail stored HTML injection in subject text
Low 3.5
In plain English
A low-severity cross-site scripting in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.3%top 80.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | >= 5.2.0-beta.1, < 5.5.3 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5 x_refsource_CONFIRM
- https://github.com/nextcloud/mail/pull/11740 x_refsource_MISC
- https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09 x_refsource_MISC
- https://hackerone.com/reports/3357036 x_refsource_MISC