CVE-2025-66514

Nextcloud Mail stored HTML injection in subject text

CVSS 3.5 LOWEPSS 0.2%CWE-79

Vexday Risk Score

8Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 3.5EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

05 dez 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Produtos afetados

nextcloud · security-advisories

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09 https://github.com/nextcloud/mail/pull/11740 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5 https://hackerone.com/reports/3357036