{"id":"CVE-2016-9465","aliases":["EUVD-2016-10271","GHSA-8r58-88c9-cfv7"],"status":"published","title":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in...","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01118,"percentile":0.66349,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2017-03-28T02:46:00Z","modified":"2026-10-24T10:49:25Z","products":[{"vendor":"nextcloud","product":"nextcloud_server"},{"vendor":"owncloud","product":"owncloud"}],"references":[{"url":"https://nextcloud.com/security/advisory/?id=nc-sa-2016-008","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://github.com/owncloud/core/commit/6bf3be3877d9d9fda9c66926fe273fe79cbaf58e","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://hackerone.com/reports/163338","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2016-018","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://github.com/nextcloud/server/commit/68ab8325c799d20c1fb7e98d670785176590e7d0","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/owncloud/core/commit/b5a5be24c418033cb2ef965a4f3f06b7b4213845","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9465"},{"url":"https://github.com/advisories/GHSA-8r58-88c9-cfv7"}],"sources":{"cve":[{"id":"CVE-2016-9465","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.","status":"published","published":"2017-03-28T02:46:00Z","modified":"2024-08-06T02:50:38.411Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:32.103757Z"}],"euvd":[{"id":"EUVD-2016-10271","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.","status":"published","published":"2017-03-28T02:46:00Z","modified":"2024-08-06T02:50:38Z","updated_at":"2026-11-03T02:22:27.235814Z"}],"ghsa":[{"id":"GHSA-8r58-88c9-cfv7","title":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in...","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.","status":"published","published":"2022-05-13T01:38:33Z","modified":"2023-02-01T05:08:53Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:50:53.268012Z"}],"nvd":[{"id":"CVE-2016-9465","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.","status":"published","published":"2017-03-28T02:59:01.043Z","modified":"2026-06-17T00:56:07.393Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-9465","description":"Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.","status":"published","published":"2017-03-28T02:59:01.043Z","modified":"2026-10-24T10:49:25.419634372Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.472693Z"}]}}