CVE-2025-66512CWE-79CWE-80cross-site-scripting

CVE-2025-66512

Medium · published December 5, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.4th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2025-12-05T22:16Z
Affected products (4)
ProductVersionsFixed in
nextcloud/nextcloud_server≥ 31.0.0, < 31.0.1231.0.12
nextcloud/nextcloud_server≥ 31.0.0, < 31.0.1231.0.12
nextcloud/nextcloud_server≥ 32.0.0, < 32.0.332.0.3
nextcloud/nextcloud_server≥ 32.0.0, < 32.0.332.0.3
References (4)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qcw2-p26m-9gc5 · [email protected]https://github.com/nextcloud/viewer/commit/5044a27d61bc40c0f134298d36af91f865335b63 · [email protected]https://github.com/nextcloud/viewer/pull/3023 · [email protected]https://hackerone.com/reports/3357808 · [email protected]
EPSS history
Timeline
  • 05 DEC 16:22Z
    Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud
    cvelistv5