A Sneak Peek into Nextcloud Contacts CSS Loading Vulnerability
The Nextcloud Contacts app, designed to effortlessly synchronize contacts across devices and enable easy editing within your Nextcloud environment, was recently found to have a security flaw. This particular vulnerability allowed a clever but unauthorized user to subtly alter their organization and title fields. These modifications could then lead to the loading of extra CSS (Cascading Style Sheets) files. While JavaScript and other potentially harmful options were effectively blocked by Nextcloud Server’s existing content security policy, this CSS-related issue still posed a minor risk.
CVE Details
This vulnerability is officially identified as CVE-2025-66554.
- Product: Nextcloud Contacts
- Published: December 05, 2025
- Severity: Low
- Status: Analyzed
Affected Products
The versions of the Nextcloud Contacts app vulnerable to this issue include all versions prior to:
- 5.5.4
- 6.0.6
- 7.2.5
Current Status
The vulnerability has been thoroughly analyzed.
Severity Level
This vulnerability is rated as Low severity, with a CVSS score of 3.5. This means that while a flaw exists, the potential impact or ease of exploitation is limited.
Possible Solutions
Nextcloud has already addressed this vulnerability. Users of the Nextcloud Contacts app should update to one of the following patched versions to ensure their system is secure:
- Nextcloud Contacts 5.5.4
- Nextcloud Contacts 6.0.6
- Nextcloud Contacts 7.2.5
Updating to these versions will fix the issue where malicious users could load additional CSS files by manipulating their profile fields.
References
https://github.com/nextcloud/contacts/commit/d954d098978dde1f121600e8b994e02f293c68b1
https://github.com/nextcloud/contacts/pull/4619
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9v78-cpfc-v6h2
https://hackerone.com/reports/3293290
