CVE-2023-33182 json
Nextcloud Contacts photos only sanitized if mime type is all lower case
published 2023-05-30 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-37365
- cvss
- 0.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 0.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Affected products
- nextcloud security-advisories
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/nextcloud/contacts/pull/3199
patch
-
github.com
/nextcloud/security-advisories/security/advisories/GHSA-hxr6-cx85-gcjx
vendor-advisory
-
hackerone.com
/reports/1789602
permissions-required
Sources
- CVE List CVE-2023-33182
- NVD CVE-2023-33182
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.