Nextcloud Contacts vulnerabilities

7 CVEs affecting Nextcloud Contacts, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-66554, published 2025-12-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-33182, published 2023-05-30. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar…
CVE-2020-8181, published 2020-07-10. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.
CVE-2020-8280, published 2021-01-06. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting (XSS) attacks.
CVE-2018-3764, published 2018-07-05. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected…
CVE-2020-8281, published 2021-01-06. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting (XSS) attacks.
CVE-2021-39221, published 2021-10-25. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For…
CVE-2025-66554, published 2025-12-05. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation…