Nextcloud Mail Stored HTML Injection Vulnerability (CVE-2025-66514)

Nextcloud Mail, a popular email application designed for the self-hosted Nextcloud platform, recently addressed a security flaw. This vulnerability, identified as CVE-2025-66514, involved a stored HTML injection issue found in the app’s message list. Essentially, a logged-in user could embed malicious HTML code within the subject lines of emails. Fortunately, Nextcloud’s robust Content Security Policy (CSP) acted as a safeguard, preventing any JavaScript-based attacks and significantly reducing the potential impact of this issue.

CVE Details

Product Name: Nextcloud Mail
Published Date: December 5, 2025
Severity: Low
Status: Analyzed

Affected Products

This vulnerability specifically impacts versions of Nextcloud Mail prior to 5.5.3. If you are running an older version of the Nextcloud Mail application, your installation is susceptible to this issue until it is updated. The vulnerability allows an authenticated attacker to inject HTML into email subjects, which could then be rendered when viewed in the message list.

Current Status

The security flaw has been thoroughly analyzed by the Nextcloud security team. A resolution has since been developed and released. This means that users can now protect their Nextcloud Mail installations by updating to the patched version. The corrective action ensures that all email subjects are properly sanitized, preventing any unintended HTML rendering.

Severity Level

CVE-2025-66514 is classified as a Low Severity vulnerability. This rating is primarily due to Nextcloud Server’s strong Content Security Policy. While an authenticated user could indeed inject HTML, the active CSP successfully blocked any attempts to execute malicious JavaScript code. This critical security measure greatly limits the potential impact, as common cross-site scripting (XSS) attacks, which depend on JavaScript execution, were not feasible. The main risks associated with this vulnerability would be visual defacement of the interface or potential phishing attempts that leverage altered email subjects, rather than a full system compromise.

Possible Solutions

The most effective and crucial step to secure your Nextcloud Mail installation is to update to version 5.5.3 or later. The fix, which was implemented in commit c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09 in the Nextcloud Mail repository, specifically addresses the HTML injection by properly escaping special characters found in email subjects. This ensures that any HTML tags that might be present in email subjects are treated as plain text and are not rendered by the web browser.

System administrators and individual users are strongly advised to apply this update promptly to mitigate any potential risks. Regularly checking for and installing the latest security updates is a fundamental and vital practice for maintaining a secure digital environment.

References

https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09
https://github.com/nextcloud/mail/pull/11740
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5
https://hackerone.com/reports/3357036