Nextcloud Contacts CVE-2025-66554

Requires an authenticated account on the target Nextcloud instance (PR:L) because the attacker must edit a contact's own organisation or title field, and requires a victim to view that contact entry (UI:R) for the injected CSS to render. Exploitation is further LIMITED to loading additional CSS files only - JavaScript and other active-content options are blocked by the Nextcloud Server content security policy, so no arbitrary script execution is possible. Affected deployments are Contacts app versions prior to 5.5.4, 6.0.6, and 7.2.5; patched instances escape these fields and are not exploitable.

This is a genuinely low-to-moderate priority issue despite being a stored injection flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) tells a consistent, self-limiting story: network-reachable but requiring an authenticated low-privileged account (PR:L), victim interaction to view the malicious contact (UI:R), and only Low confidentiality/integrity impact. Critically, the description confirms the attack is constrained to loading additional CSS files - JavaScript and other dangerous sinks were already blocked by the Nextcloud Server content security policy - so this is effectively CSS injection rather than full script execution, which caps real-world impact (UI defacement, limited CSS-based data inference) well below a typical XSS. Corroborating signals align: EPSS is 0.02% (5th percentile), i.e. negligible predicted exploitation, and the vulnerability is NOT on CISA KEV. The one elevating signal is a publicly available proof-of-concept (a GitHub gist), but POC availability is distinct from active exploitation and the low EPSS plus absent KEV status indicate no evidence of in-the-wild use. Net: a legitimate finding worth patching on normal cadence, not an emergency - the CSP mitigation is the key reason this did not become a critical XSS.

An attacker with a valid, low-privileged account on a shared Nextcloud instance edits the organisation or title field of a contact entry, injecting markup that causes the Contacts app to load an attacker-controlled external CSS file. When another user opens or views that contact, the malicious CSS renders in their session, enabling UI manipulation/defacement and limited CSS-based data exfiltration; JavaScript is blocked by the server CSP. A public proof-of-concept exists (GitHub gist), lowering the bar to reproduce.