Back to Database
Status published
Low
CVE-2023-39955
Notes attachment render HTML in preview mode
Vulnerability Description
Notes is a note-taking app for Nextcloud, an open-source cloud platform. Starting in version 4.4.0 and prior to version 4.8.0, when creating a note file with HTML, the content is rendered in the preview instead of the file being offered to download. Nextcloud Notes app version 4.8.0 contains a patch for the issue. No known workarounds are available.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-39955
Credits & Attribution
No credits recorded in the NVD database.
References
More from nextcloud
View All →CVE-2025-66558
Nextcloud Twofactor WebAuthn app was updated based on public key
Low
3.1
CVE-2025-66557
Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners
Medium
5.4
CVE-2025-66556
Nextcloud talk allows participants to blindly delete poll drafts of other users by ID
Low
3.5
CVE-2025-66554
Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field
Low
3.5
CVE-2025-66553
Nextcloud Tables app allowed users to view columns metadata information of any table
Medium
4.3
Affected Vendor
nextcloud
View all reports →Affected Software
security-advisories
Vulnerable Versions:
>= 4.4.0, < 4.8.0
Timeline
Official Publish:
August 10th, 2023
Last Modified:
October 4th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N