CVE-2025-66514

LowCVSS 3.5

Published: 05/12/2025(UTC)Updated: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

In the Nextcloud Mail app prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into email subjects. JavaScript was correctly blocked by the content security policy of the Nextcloud Server code.

Risk Assessment

An attacker can inject arbitrary HTML into message subjects, potentially leading to phishing or user deception. JavaScript execution was blocked, limiting the attack's scope.

Recommendation

Update the Nextcloud Mail app to version 5.5.3 or later. It is also advisable to warn users about suspicious message subjects containing unusual HTML.

Other vulnerabilities in Nextcloud Mail

CVE-2023-33184Low
Nextcloud Mail is a mail app in Nextcloud that is vulnerable to a blind SSRF attack. This attack allows sending GET requests to services running on the same web server.

Original NVD description (English source)

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS