CVE-2025-66554: Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked by the content security policy of the Nextcloud Server code. This vulnerability is fixed in 5.5.4, 6.0.6, and 7.2.5.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66554?
CVE-2025-66554 is classified as a moderate severity vulnerability.
How do I fix CVE-2025-66554?
To fix CVE-2025-66554, upgrade to Nextcloud Contacts version 5.5.4, 6.0.6, or 7.2.5 or later.
What types of attacks does CVE-2025-66554 enable?
CVE-2025-66554 allows a malicious user to inject additional CSS files through modified organisation and title fields.
Which versions of Nextcloud Contacts are affected by CVE-2025-66554?
CVE-2025-66554 affects Nextcloud Contacts versions prior to 5.5.4, 6.0.6, and 7.2.5.
Is user interaction required to exploit CVE-2025-66554?
Yes, user interaction is typically required for the exploitation of CVE-2025-66554.