Medium severity · published Dec 5, 2025
CVE-2025-66514
Nextcloud Mail stored HTML injection in subject text
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
security-advisories · nextcloud
>= 5.2.0-beta.1, < 5.5.3 · source: vendor
MA
Mail · Nextcloud
before 5.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66514
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66514
Patch
https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09
Issue Tracking
https://github.com/nextcloud/mail/pull/11740
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5
Permissions Required
https://hackerone.com/reports/3357036
More from security-advisories
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.8
CVE-2026-45284
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
8.2
CVE-2026-45545
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
8.2
CVE-2024-52519
Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
8.1
CVE-2026-45281
Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update