Medium severity · published Dec 5, 2025
CVE-2025-66554
Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked by the content security policy of the Nextcloud Server code. This vulnerability is fixed in 5.5.4, 6.0.6, and 7.2.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
security-advisories · nextcloud
>= 7.0.0-alpha.1, < 7.2.5; >= 6.0.0-alpha1, < 6.0.6; < 5.5.4 · source: vendor
CO
Contacts · Nextcloud
5.0.0 before 5.5.4; 6.0.0 before 6.0.6; 7.0.0 before 7.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66554
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66554
Patch
https://github.com/nextcloud/contacts/commit/d954d098978dde1f121600e8b994e02f293c68b1
Issue Tracking
https://github.com/nextcloud/contacts/pull/4619
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9v78-cpfc-v6h2
Permissions Required
https://hackerone.com/reports/3293290
More from security-advisories
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.8
CVE-2026-45284
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
8.2
CVE-2026-45545
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
8.2
CVE-2024-52519
Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
8.1
CVE-2026-45281
Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update