Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09 Patch
- https://github.com/nextcloud/mail/pull/11740 Issue Tracking, Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5 Patch, Vendor Advisory
- https://hackerone.com/reports/3357036 Permissions Required, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.4 · nextcloudNVD modified 2026-10-15 21:10
Affected (CPE criteria) 1
cpe:2.3:a:nextcloud:mail:*:*:*:*:*:nextcloud:*:*
References 4
- https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09 Patch
- https://github.com/nextcloud/mail/pull/11740 Issue Tracking, Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5 Patch, Vendor Advisory
- https://hackerone.com/reports/3357036 Permissions Required, Vendor Advisory