6.1
CVE-2025-66512
- EPSS 0.02%
- Veröffentlicht 05.12.2025 16:22:50
- Zuletzt bearbeitet 09.12.2025 16:38:19
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud
XSS in SVG images when opened outside of Nextcloud
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page.
Mögliche Gegenmaßnahme
Server: * No workaround available
Enterprise Server: * No workaround available
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Nextcloud Server SwEdition- Version >= 31.0.0 < 31.0.12
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 31.0.0 < 31.0.12
Nextcloud ≫ Nextcloud Server SwEdition- Version >= 32.0.0 < 32.0.3
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 32.0.0 < 32.0.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
LoginWeitere Schwachstelleninformationen
SystemNextcloud
≫
Produkt
Server
Version
>= 31.0.0, < 31.0.12
Version
>= 32.0.0, < 32.0.3
SystemNextcloud
≫
Produkt
Enterprise Server
Version
>= 31.0.0, < 31.0.12
Version
>= 32.0.0, < 32.0.3
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.02% | 0.053 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
| security-advisories@github.com | 5.4 | 2.8 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.