What’s Vulnerable › Vulnerabilities

CVE-2025-66512: Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-05 · updated 2026-10-18
• Weakness: CWE-80

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page.

Affected products

• Nextcloud Server: from 31.0.0 before 31.0.12; from 32.0.0 before 32.0.3 — fixed in 31.0.12, 32.0.3

How to fix

Upgrade to a fixed version: Nextcloud Server 31.0.12, 32.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qcw2-p26m-9gc5
• https://github.com/nextcloud/viewer/commit/5044a27d61bc40c0f134298d36af91f865335b63
• https://github.com/nextcloud/viewer/pull/3023
• https://hackerone.com/reports/3357808

Get alerted when CVE-2025-66512 or the next vulnerability affects your stack