CVE-2025-66514: Nextcloud Mail XSS Vulnerability

CVE-2025-66514 Overview

CVE-2025-66514 is a stored HTML injection vulnerability in Nextcloud Mail, the mail app for the Nextcloud self-hosted productivity platform. Versions prior to 5.5.3 fail to escape HTML in email subject lines rendered in the message list. An authenticated user can inject HTML markup into subjects, which is then rendered when other recipients view the message list. JavaScript execution is blocked by the Nextcloud Server content security policy (CSP), limiting the impact to HTML content injection rather than full cross-site scripting [CWE-79].

Critical Impact
Attackers with authenticated access can inject arbitrary HTML into the Mail app message list, enabling content spoofing and UI manipulation against recipients.

Affected Products

Nextcloud Mail versions prior to 5.5.3
Self-hosted Nextcloud deployments running the Mail app
Multi-tenant Nextcloud instances where users exchange email

Discovery Timeline

2025-12-05 - CVE-2025-66514 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66514

Vulnerability Analysis

The vulnerability resides in the Mail app's Vue frontend, specifically in src/components/Envelope.vue. The component returns raw subject strings when rendering the message list without applying HTML escaping. When an attacker sends an email with HTML markup in the Subject header, the Mail app injects that markup directly into the DOM.

The Nextcloud Server CSP blocks inline JavaScript execution, so the impact is contained to HTML-level injection. Attackers can still render arbitrary links, images, styled elements, and formatting that may be used for phishing, UI redressing, or brand impersonation inside the trusted Mail interface.

Root Cause

The root cause is missing output encoding on untrusted user-controlled data. The subject field, sourced from inbound email headers, is passed to the template without being processed by an HTML escape routine. The fix wraps the return value with escapeHtml() before it reaches the view layer.

Attack Vector

An authenticated attacker sends an email to a victim running Nextcloud Mail. The email's subject contains HTML tags. When the victim opens the Mail app message list, the injected markup is rendered in the context of the Nextcloud origin. User interaction is required to view the folder containing the crafted message.

text

// Patch: src/components/Envelope.vue
                    escape: false,
                })
            }
-           return subject
+           return escapeHtml(subject)
        },
        storeActions() {
            return this.mainStore.getQuickActions()

Source: Nextcloud Mail commit c64fcc3

Detection Methods for CVE-2025-66514

Indicators of Compromise

Inbound emails containing HTML tags such as <a>, <img>, <style>, or <iframe> embedded directly in the Subject header.
Unusual Unicode or encoded sequences in email subjects that decode to HTML markup.
User reports of malformed, visually spoofed, or unexpected clickable content in the Nextcloud Mail message list.

Detection Strategies

Parse the Subject header on inbound mail at the gateway and alert on messages that contain < and > paired with known HTML tag names.
Review Nextcloud Mail app logs for message IDs delivered to multiple internal recipients that contain suspicious subject patterns.
Audit installed Nextcloud Mail app versions across tenants and flag any instance below 5.5.3.

Monitoring Recommendations

Monitor the Nextcloud server for the installed Mail app version via occ app:list and alert when version drift is detected.
Correlate inbound SMTP metadata with user access patterns on the /apps/mail endpoint to identify victims who viewed crafted messages.
Track CSP violation reports from the Nextcloud frontend to surface attempts to escalate HTML injection into script execution.

How to Mitigate CVE-2025-66514

Immediate Actions Required

Upgrade Nextcloud Mail to version 5.5.3 or later on every Nextcloud instance.
Validate that the Nextcloud Server CSP is enforced and has not been relaxed by custom configuration.
Communicate guidance to users to report suspicious links or formatting observed inside the Mail app message list.

Patch Information

The fix is committed in c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09 and merged through Nextcloud Mail pull request #11740. Full details are documented in the GitHub Security Advisory GHSA-v394-8gpc-6fv5 and the originating HackerOne report #3357036. Administrators should apply the Mail app update through the Nextcloud App Store or occ app:update mail.

Workarounds

No official workaround is documented; upgrading to Mail 5.5.3 is the supported remediation.
As a temporary mitigation, administrators can disable the Mail app via occ app:disable mail until the patched version is deployed.
Enforce strict inbound mail filtering that rejects or strips HTML content from the Subject header at the mail gateway.

bash

# Update the Nextcloud Mail app to the patched version
sudo -u www-data php occ app:update mail
sudo -u www-data php occ app:list | grep -i mail

# Temporary mitigation: disable the Mail app until patched
sudo -u www-data php occ app:disable mail