CVE-2025-66554: Nextcloud Contacts XSS Vulnerability

CVE-2025-66554 Overview

CVE-2025-66554 is a stored cross-site scripting (XSS) vulnerability in the Nextcloud Contacts application. Authenticated users can inject unescaped content into the organisation and title fields of a contact. The injected payload loads additional Cascading Style Sheets (CSS) files when another user views the affected contact. The Nextcloud Server Content Security Policy (CSP) blocks JavaScript and other active content, limiting impact to CSS-based attacks. The flaw is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can inject CSS into contact fields that render in other users' browsers, enabling data exfiltration via CSS selectors and user interface manipulation.

Affected Products

Nextcloud Contacts versions prior to 5.5.4
Nextcloud Contacts versions prior to 6.0.6
Nextcloud Contacts versions prior to 7.2.5

Discovery Timeline

2025-12-05 - CVE-2025-66554 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2025-66554

Vulnerability Analysis

The vulnerability resides in the contact rendering components of the Nextcloud Contacts app, specifically src/components/ContactDetails.vue and src/views/ReadOnlyContactDetails.vue. These components rendered the organisation and title fields without HTML escaping. An authenticated user could store crafted markup in these fields that, when displayed to another user, triggered the browser to load attacker-controlled CSS.

While the Nextcloud Server CSP successfully blocked <script> elements and other active content, it did not prevent injection of <link> or <style> elements that reference external stylesheets. CSS-based attacks can exfiltrate attribute values through selector-driven background image requests, overlay phishing content on top of the Contacts UI, or redraw interface elements to deceive users.

Root Cause

The root cause is missing output encoding when rendering user-controlled contact metadata inside Vue templates. The affected properties were interpolated into the DOM without passing through an HTML escaping routine, allowing stored markup to be parsed as part of the page.

Attack Vector

Exploitation requires an authenticated account that can create or edit a contact shared with or visible to the target user. The attacker sets the organisation or title field to contain CSS-injection markup. When the victim opens the contact, their browser parses the injected markup and fetches external CSS resources controlled by the attacker. User interaction (viewing the contact) is required.

text

// Security patch in src/components/ContactDetails.vue
 </template>
 
 <script>
+import escape from 'lodash/fp/escape.js'
 import { showError } from '@nextcloud/dialogs'
 
 import ICAL from 'ical.js'

Source: GitHub Commit d954d09

text

// Security patch in src/views/ReadOnlyContactDetails.vue
 </template>
 
 <script>
+import escape from 'lodash/fp/escape.js'
 import { isMobile, NcEmptyContent, NcLoadingIcon } from '@nextcloud/vue'
 import IconContact from 'vue-material-design-icons/AccountMultiple.vue'
 import mitt from 'mitt'

Source: GitHub Commit d954d09

The patch imports lodash/fp/escape.js and applies HTML escaping to the organisation and title values before rendering.

Detection Methods for CVE-2025-66554

Indicators of Compromise

Contact records whose ORG or TITLE vCard properties contain HTML tags such as <link>, <style>, or attributes referencing external URLs.
Outbound HTTP requests from end-user browsers to unexpected domains while browsing the Nextcloud Contacts UI.
CardDAV sync events that update ORG or TITLE fields with unusually long or markup-containing values.

Detection Strategies

Query the Nextcloud Contacts database or CardDAV store for ORG and TITLE values matching regular expressions for HTML tag syntax.
Review web server and reverse proxy logs for PUT and PATCH requests to CardDAV endpoints that contain encoded tag characters in the payload.
Correlate browser-side Content Security Policy violation reports with sessions that recently loaded the Contacts app.

Monitoring Recommendations

Enable and ingest Nextcloud audit logs covering contact creation and modification events.
Monitor egress traffic from authenticated user sessions to external domains that are not part of the Nextcloud deployment.
Alert on repeated requests to the same external host originating from users viewing shared contacts.

How to Mitigate CVE-2025-66554

Immediate Actions Required

Upgrade the Nextcloud Contacts app to version 5.5.4, 6.0.6, or 7.2.5 depending on the deployed major release.
Audit existing contact entries for ORG and TITLE fields containing HTML markup and sanitize or remove offending records.
Review user accounts with write access to shared address books and confirm their legitimacy.

Patch Information

The fix is tracked in Nextcloud Pull Request #4619 and merged in commit d954d09. Additional detail is available in the GitHub Security Advisory GHSA-9v78-cpfc-v6h2 and the corresponding HackerOne Report #3293290. The patch introduces lodash/fp/escape.js to HTML-escape the organisation and title fields before DOM insertion.

Workarounds

Restrict address book sharing to trusted users until the upgrade can be deployed.
Tighten the Nextcloud Server Content Security Policy to disallow external stylesheet loading where feasible.
Disable the Contacts app temporarily if upgrading is not immediately possible and address book use is non-critical.

bash

# Upgrade the Contacts app using the Nextcloud occ CLI
sudo -u www-data php occ app:update contacts
sudo -u www-data php occ app:list | grep contacts