CVE-2025-66514CWE-79cross-site-scripting

CVE-2025-66514

Low · published December 5, 2025

CVSS v3.1
3.5
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00250 · 15.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-05T23:15Z
Affected products (1)
ProductVersionsFixed in
nextcloud/mail< 5.5.35.5.3
References (4)
https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09 · [email protected]https://github.com/nextcloud/mail/pull/11740 · [email protected]https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5 · [email protected]https://hackerone.com/reports/3357036 · [email protected]
EPSS history
Timeline
  • 05 DEC 17:32Z
    Nextcloud Mail stored HTML injection in subject text
    cvelistv5