CVE-2025-66514

3.5 LOW
Published: December 05, 2025 Modified: December 09, 2025
View on NVD

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09
Source: security-advisories@github.com
Patch
https://github.com/nextcloud/mail/pull/11740
Source: security-advisories@github.com
Issue Tracking Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5
Source: security-advisories@github.com
Patch Vendor Advisory
https://hackerone.com/reports/3357036
Source: security-advisories@github.com
Permissions Required Vendor Advisory

4 reference(s) from NVD

Quick Stats

CVSS v3 Score
3.5 / 10.0
EPSS (Exploit Probability)
0.0%
2th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-79

Affected Vendors

nextcloud

Related CVEs

CVE-2025-52691 10.0
CVE-2025-15168 7.3
CVE-2025-15167 7.3
CVE-2025-15166 7.3
CVE-2025-15165 7.3