Low severity3.5NVD Advisory· Published Dec 5, 2025· Updated Jun 17, 2026

CVE-2025-66514

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nextcloud/Mail2 versions
cpe:2.3:a:nextcloud:mail:*:*:*:*:*:nextcloud:*:*+ 1 more
- cpe:2.3:a:nextcloud:mail:*:*:*:*:*:nextcloud:*:*range: <5.5.3
- (no CPE)range: <5.5.3
Nextcloud/security-advisoriescpe-rescue
Range: >= 5.2.0-beta.1, < 5.5.3

Patches

Vulnerability mechanics

References

github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09nvdPatch
github.com/nextcloud/mail/pull/11740nvdIssue TrackingPatch
github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5nvdPatchVendor Advisory
hackerone.com/reports/3357036nvdPermissions RequiredVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.227
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000