Medium severity · published Dec 5, 2025
CVE-2025-66554
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked by the content security policy of the Nextcloud Server code. This vulnerability is fixed in 5.5.4, 6.0.6, and 7.2.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Contacts · Nextcloud
5.0.0 before 5.5.4; 6.0.0 before 6.0.6; 7.0.0 before 7.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66554
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66554
Patch
https://github.com/nextcloud/contacts/commit/d954d098978dde1f121600e8b994e02f293c68b1
Issue Tracking
https://github.com/nextcloud/contacts/pull/4619
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9v78-cpfc-v6h2
Permissions Required
https://hackerone.com/reports/3293290
More from Contacts
5.4
CVE-2021-39221
Nextcloud is an open-source, self-hosted productivity platform
5.4
CVE-2020-8281
A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting (XSS) attacks
5.4
CVE-2020-8280
A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting (XSS) attacks
4.8
CVE-2018-3764
In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction
4.3
CVE-2023-33182
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing