CVE-2021-39221

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Contacts application is upgraded to 4.0.3. As a workaround, one may use a browser that has support for Content-Security-Policy.

• CWE-79
• CWE-434

• https://github.com/nextcloud/contacts/pull/2407Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j6cx-mxqf-f9vcThird Party Advisory
• https://github.com/nextcloud/contacts/pull/2407Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j6cx-mxqf-f9vcThird Party Advisory

Published

Oct 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39216Wasmtime is an open source runtime for WebAssembly & WASI. I…6.3
• CVE-2021-39217OpenMage LTS is an e-commerce platform. Prior to versions 19…7.2
• CVE-2021-39218Wasmtime is an open source runtime for WebAssembly & WASI. I…6.3
• CVE-2021-39219Wasmtime is an open source runtime for WebAssembly & WASI. W…6.3
• CVE-2021-3922A race condition vulnerability was reported in IMController,…7
• CVE-2021-39220Nextcloud is an open-source, self-hosted productivity platfo…3.5
• CVE-2021-39222Nextcloud is an open-source, self-hosted productivity platfo…6.1
• CVE-2021-39223Nextcloud is an open-source, self-hosted productivity platfo…5.3
• CVE-2021-39224Nextcloud is an open-source, self-hosted productivity platfo…5.3
• CVE-2021-39225Nextcloud is an open-source, self-hosted productivity platfo…8.1
• CVE-2021-39226Grafana is an open source data visualization platform. In af…7.3
• CVE-2021-39227ZRender is a lightweight graphic library providing 2d draw f…9.8