CVE-2025-66512
- Source
- https://cve.org/CVERecord?id=CVE-2025-66512
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66512.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-66512
- Aliases
-
- GHSA-qcw2-p26m-9gc5
- Published
- 2025-12-05T16:22:50.206Z
- Modified
- 2026-08-12T03:51:33.257405029Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CVSS Calculator
- Summary
- Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud
- Details
-
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page.
- Database specific
{ "cwe_ids": [ "CWE-80" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66512.json", "cna_assigner": "GitHub_M" }- References
-
- https://hackerone.com/reports/3357808
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66512.json
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qcw2-p26m-9gc5
- https://nvd.nist.gov/vuln/detail/CVE-2025-66512
- https://github.com/nextcloud/viewer/commit/5044a27d61bc40c0f134298d36af91f865335b63
- https://github.com/nextcloud/viewer/pull/3023
Affected packages
Git / github.com/nextcloud/server
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nextcloud/server
- Events
- Database specific
-
Show details
{ "cpe": [ "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*", "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*" ], "extracted_events": [ { "introduced": "31.0.0" }, { "fixed": "31.0.12" }, { "introduced": "32.0.0" }, { "fixed": "32.0.3" } ], "source": "CPE_RANGE" }
- Type
- GIT
- Repo
- https://github.com/nextcloud/viewer
- Events
-
IntroducedIntroduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "source": [ "AFFECTED_FIELD", "REFERENCES" ], "extracted_events": [ { "introduced": "32.0.0beta1" }, { "fixed": "32.0.3" }, { "introduced": "0" }, { "fixed": "31.0.12" } ] }
Affected versions
v16.*
v16.0.0RC1
v16.0.0alpha1
v16.0.0beta1
v16.0.0beta2
v16.0.0beta3
v16.0.4RC1
v17.*
v17.0.0beta1
v17.0.0beta2
v17.0.0beta3
v17.0.0beta4
v18.*
v18.0.0RC1
v18.0.0RC2
v18.0.0beta1
v18.0.0beta2
v18.0.0beta3
v18.0.0beta4
v19.*
v19.0.0
v19.0.0RC1
v19.0.0RC2
v19.0.0RC3
v19.0.0beta1
v19.0.0beta2
v19.0.0beta3
v19.0.0beta4
v19.0.0beta5
v19.0.0beta6
v19.0.0beta7
v20.*
v20.0.0
v20.0.0RC1
v20.0.0RC2
v20.0.0beta1
v20.0.0beta2
v20.0.0beta3
v20.0.0beta4
v21.*
v21.0.0RC1
v21.0.0beta1
v21.0.0beta2
v21.0.0beta3
v21.0.0beta4
v21.0.0beta5
v21.0.0beta6
v21.0.0beta7
v21.0.0beta8
v22.*
v22.0.0
v22.0.0beta1
v22.0.0beta2
v22.0.0beta3
v22.0.0beta4
v22.0.0beta5
v22.0.0rc1
v22.0.0rc2
v23.*
v23.0.0
v23.0.0beta1
v23.0.0beta2
v23.0.0beta3
v23.0.0rc1
v23.0.0rc2
v23.0.0rc3
v24.*
v24.0.0beta1
v24.0.0beta2
v24.0.0beta3
v24.0.0rc1
v24.0.0rc2
v24.0.0rc3
v25.*
v25.0.0beta1
v25.0.0beta2
v25.0.0beta3
v25.0.0beta4
v25.0.0beta5
v25.0.0beta6
v25.0.0beta7
v25.0.0rc1
v26.*
v26.0.0beta1
v26.0.0beta2
v26.0.0beta3
v26.0.0beta4
v26.0.0beta5
v26.0.0rc1
v27.*
v27.0.0beta1
v27.0.0beta2
v27.0.0rc1
v28.*
v28.0.0beta1
v28.0.0beta2
v28.0.0beta3
v28.0.0beta4
v29.*
v29.0.0beta1
v29.0.0beta2
v29.0.0beta3
v29.0.0beta4
v29.0.0beta5
v29.0.0beta6
v29.0.0rc1
v30.*
v30.0.0beta1
v30.0.0beta2
v30.0.0beta3
v30.0.0beta4
v30.0.0beta5
v30.0.0rc1
v31.*
v31.0.0
v31.0.0beta1
v31.0.0beta2
v31.0.0beta3
v31.0.0beta4
v31.0.0beta5
v31.0.0rc1
v31.0.0rc2
v31.0.0rc3
v31.0.0rc4
v31.0.0rc5
v31.0.1
v31.0.10
v31.0.10rc1
v31.0.10rc2
v31.0.11
v31.0.11rc1
v31.0.11rc2
v31.0.12rc1
v31.0.12rc2
v31.0.12rc3
v31.0.1rc1
v31.0.1rc2
v31.0.2
v31.0.2rc1
v31.0.3
v31.0.3rc1
v31.0.3rc2
v31.0.4
v31.0.4rc1
v31.0.5
v31.0.5rc1
v31.0.6
v31.0.6rc1
v31.0.6rc2
v31.0.7
v31.0.7rc1
v31.0.8
v31.0.8rc1
v31.0.9
v31.0.9rc1
v32.*
v32.0.0
v32.0.0beta1
v32.0.0beta2
v32.0.0beta3
v32.0.0beta4
v32.0.0beta5
v32.0.0rc1
v32.0.0rc2
v32.0.0rc3
v32.0.0rc4
v32.0.1
v32.0.1rc1
v32.0.1rc2
v32.0.2
v32.0.2rc1
v32.0.2rc2
v32.0.3rc1
v32.0.3rc2