CVE-2025-66512 — Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to…
Published: 2025-12-05 · CVSS: 5.4 · CVSS 3.1
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7