CVE-2025-66514 — Nextcloud Mail stored HTML injection in subject text
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticate…
Published: 2025-12-05 · CVSS: 3.5 · CVSS 3.1
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7