Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.

INFO

Published Date :

2025-12-05T17:32:25.767Z

Last Modified :

2025-12-08T20:10:21.710Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-66514 vulnerability.

Vendors Products
Nextcloud
  • Mail
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-66514.

URL Resource
https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09 cve-icon cve-icon
https://github.com/nextcloud/mail/pull/11740 cve-icon cve-icon
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5 cve-icon cve-icon
https://hackerone.com/reports/3357036 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact