Read the docs
TI-2023-16359 Aliases CVE-2023-33182

Nextcloud Contacts photos only sanitized if mime type is all lower case

Priority LOW 22CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00848 58th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 4.2.4, 5.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextcloudsecurity-advisories4.1.0 to before 4.2.4; 5.0.0 to before 5.0.34.2.4, 5.0.3Patch availableCNA
  • security-advisories Vendornextcloud Affected 4.1.0 to before 4.2.4; 5.0.0 to before 5.0.3 Fixed in 4.2.4, 5.0.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nextcloud:contacts:*:*:*:*:*:*:*:*4.1.0 to before 4.2.4; 5.0.0 to before 5.0.3Vulnerablenextcloud
  • cpe:2.3:a:nextcloud:contacts:*:*:*:*:*:*:*:* Versions 4.1.0 to before 4.2.4; 5.0.0 to before 5.0.3 Vulnerable ·nextcloud

Remediation

  • Fix · CNA security-advisories (nextcloud) Fixed in 4.2.4, 5.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-33182

References

Patch 1

Advisory 1

Other 1

  • TI-2021-16606 XSS in Contacts CVSS 3.1MEDIUM 6.4
  • TI-2020-06698 Cross-site scripting in Nextcloud Contacts CVSS 3.1MEDIUM 5.4
  • TI-2020-06697 Cross-site scripting in Nextcloud Contacts CVSS 3.1MEDIUM 5.4
  • TI-2025-40965 Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field CVSS 3.1MEDIUM 5.4
  • TI-2018-02760 Cross-site scripting in Nextcloud Contacts application CVSS 3.1MEDIUM 4.8
  • TI-2020-06599 A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars. CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences