CVE-2023-33182
mediumpriority · track · 17EPSS 0.008 · 58 %ileEUUSEPSS · scored 2026-10-28
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · none–medium · 0–4.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-33182/cnnvd
- https://github.com/nextcloud/contacts/pull/3199cnnvd
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-cx85-gcjxcnnvd
- https://hackerone.com/reports/1789602cnnvd
- https://github.com/nextcloud/contacts/pull/3199enisa_euvd
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-cx85-gcjxenisa_euvd
- https://hackerone.com/reports/1789602enisa_euvd
- https://github.com/nextcloud/contacts/pull/3199Patchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan