What’s Vulnerable › Vulnerabilities

CVE-2025-66514: Nextcloud Mail stored HTML injection in subject text

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-05 · updated 2026-10-15
• Weakness: CWE-79

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.

Affected products

• nextcloud Mail: before 5.5.3 — fixed in 5.5.3

How to fix

Upgrade to a fixed version: nextcloud Mail 5.5.3. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09
• https://github.com/nextcloud/mail/pull/11740
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5
• https://hackerone.com/reports/3357036

Get alerted when CVE-2025-66514 or the next vulnerability affects your stack