VULNERABILITY INTELLIGENCE

CVE-2025-66554

CVSS score3.5 LOW

EPSS probability0.25%

CISA KEVNot currently listed

Published2025-12-05

Last modified2026-10-15

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Description

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked by the content security policy of the Nextcloud Server code. This vulnerability is fixed in 5.5.4, 6.0.6, and 7.2.5.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Issue Tracking, Patch
security-advisories@github.com — Patch, Vendor Advisory
security-advisories@github.com — Permissions Required, Vendor Advisory