Vulnerability · Published Dec 5, 2025 · Assigned by GitHub_M

CVE-2025-66554Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field

Low 3.5

In plain English

A low-severity cross-site scripting in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 80.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked by the content security policy of the Nextcloud Server code. This vulnerability is fixed in 5.5.4, 6.0.6, and 7.2.5.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>= 7.0.0-alpha.1, < 7.2.5>= 6.0.0-alpha1, < 6.0.6< 5.5.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9v78-cpfc-v6h2 x_refsource_CONFIRM
https://github.com/nextcloud/contacts/pull/4619 x_refsource_MISC
https://github.com/nextcloud/contacts/commit/d954d098978dde1f121600e8b994e02f293c68b1 x_refsource_MISC
https://hackerone.com/reports/3293290 x_refsource_MISC