CVE-2018-3763: Nextcloud Calendar

Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days.

In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.

Affected products

• Nextcloud Calendar: before 1.5.8 (fixed in 1.5.8); version 1.6.0 only

Published 2018-07-05. Last modified 2026-06-17.