CVE-2025-66514

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.

CVSS 3.1

5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2025-12-05

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• nextcloud:mail

References

• https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09
• https://github.com/nextcloud/mail/pull/11740
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5
• https://hackerone.com/reports/3357036

Check your stackJSON