Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field
Priority LOW 24CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked by the content security policy of the Nextcloud Server code. This vulnerability is fixed in 5.5.4, 6.0.6, and 7.2.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00268 19th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 7.2.5, 6.0.6, 5.5.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | 7.0.0-alpha.1 to before 7.2.5; 6.0.0-alpha1 to before 6.0.6; before 5.5.4 | 7.2.5, 6.0.6, 5.5.4 | Patch available | CNA |
- security-advisories Vendornextcloud Affected 7.0.0-alpha.1 to before 7.2.5; 6.0.0-alpha1 to before 6.0.6; before 5.5.4 Fixed in 7.2.5, 6.0.6, 5.5.4 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:contacts:*:*:*:*:*:*:*:* | 5.0.0 to before 5.5.4; 6.0.0 to before 6.0.6; 7.0.0 to before 7.2.5 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:contacts:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.5.4; 6.0.0 to before 6.0.6; 7.0.0 to before 7.2.5 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 7.2.5, 6.0.6, 5.5.4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66554
References
More nextcloud Contacts vulnerabilities
- TI-2021-16606 XSS in Contacts CVSS 3.1MEDIUM 6.4
- TI-2020-06698 Cross-site scripting in Nextcloud Contacts CVSS 3.1MEDIUM 5.4
- TI-2020-06697 Cross-site scripting in Nextcloud Contacts CVSS 3.1MEDIUM 5.4
- TI-2018-02760 Cross-site scripting in Nextcloud Contacts application CVSS 3.1MEDIUM 4.8
- TI-2023-16359 Nextcloud Contacts photos only sanitized if mime type is all lower case CVSS 3.1MEDIUM 4.3
- TI-2020-06599 A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars. CVSS 3.1MEDIUM 4.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences