Back Linuxsecurity

Fedora 43 Nextcloud Security Advisory XSS Security Bypass 2026

Linuxsecurity •LinuxSecurity Advisories • August 25, 2026

Find practical guidance for preventing, investigating, and responding to Linux security problems. Review Linux Privileges ×

NextCloud gives you universal access to your files through a web interface or

WebDAV. It also provides a platform to easily view & sync your contacts,

calendars and bookmarks across all your devices and enables basic editing right

on the web. NextCloud is extendable via a simple but powerful API for

applications and plugins.

* Sun Aug 16 2026 Andrew Bauer - 34.0.3-1 - 34.0.3 release RHBZ#2515297

[ 1 ] Bug #2506849 - CVE-2026-66010 nextcloud: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass [fedora-all] [ 2 ] Bug #2507002 - CVE-2026-65903 nextcloud: DOMPurify: Security bypass allows injection of malicious content [fedora-all] [ 3 ] Bug #2507015 - CVE-2026-65903 nextcloud: DOMPurify: Security bypass allows injection of malicious content [epel-all] [ 4 ] Bug #2508375 - CVE-2026-59883 nextcloud: Guzzle: Cross-host cookie disclosure and injection due to improper domain matching in CookieJar. [fedora-all] [ 5 ] Bug #2508377 - CVE-2026-59883 nextcloud: Guzzle: Cross-host cookie disclosure and injection due to improper domain matching in CookieJar. [epel-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-625cbe86c8' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical XSS Vulnerabilities in Nextcloud Affecting Fedora Users Multiple security vulnerabilities have been identified in Nextcloud versions running on Fedora, specifically CVE-2026-66010, CVE-2026-65903, and CVE-2026-59883. These vulnerabilities include a Cross-Site Scripting (XSS) attack vector that allows attackers to inject malicious content via custom element attributes and improper domain matching in cookies. The vulnerabilities were published between July 8 and July 24, 2026, and affect users of Nextcloud on Fedora systems. Administrators are urged to apply the latest updates to mitigate these risks. The advisory recommends using the 'dnf' update program to install necessary patches. The vulnerabilities could potentially lead to unauthorized access to sensitive information and compromise user data. Current status indicates that patches are available, but the risk remains until all systems are updated. 2 sources 61

Extracted Entities

Fedora 43 Nextcloud Security Advisory XSS Security Bypass 2026

The full story

Extracted Entities

Companies (1)

CVEs (3)

CWE Weaknesses (2)

Platforms (2)

Vulnerabilities (1)