CVE-2025-66512

Description

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page.

PUBLISHED Reserved 2025-12-03 | Published 2025-12-05 | Updated 2025-12-05 | Assigner GitHub_M

Problem types

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Product status

References

github.com/...sories/security/advisories/GHSA-qcw2-p26m-9gc5

github.com/nextcloud/viewer/pull/3023

github.com/...ommit/5044a27d61bc40c0f134298d36af91f865335b63

hackerone.com/reports/3357808

cve.org (CVE-2025-66512)

nvd.nist.gov (CVE-2025-66512)