Content Security Bypass in Nextcloud Server by Malicious SVG Interaction
CVE-2025-66512
5.4MEDIUM
What is CVE-2025-66512?
A vulnerability in Nextcloud Server and Nextcloud Server Enterprise allows attackers to bypass the content security policy. Malicious users can exploit this flaw by tricking unsuspecting users into viewing an uploaded SVG file outside of the controlled environment of the Nextcloud platform. The absence of proper sanitization measures contributes to this vulnerability, potentially exposing users to a range of security risks.
Affected Version(s)
security-advisories >= 32.0.0beta1, < 32.0.3 < 32.0.0beta1, 32.0.3
security-advisories < 31.0.12 < 31.0.12