Critical XSS Vulnerabilities in Nextcloud Affecting Fedora Users

Multiple security vulnerabilities have been identified in Nextcloud versions running on Fedora, specifically CVE-2026-66010, CVE-2026-65903, and CVE-2026-59883. These vulnerabilities include a Cross-Site Scripting (XSS) attack vector that allows attackers to inject malicious content via custom element attributes and improper domain matching in cookies. The vulnerabilities were published between July 8 and July 24, 2026, and affect users of Nextcloud on Fedora systems. Administrators are urged to apply the latest updates to mitigate these risks. The advisory recommends using the 'dnf' update program to install necessary patches. The vulnerabilities could potentially lead to unauthorized access to sensitive information and compromise user data. Current status indicates that patches are available, but the risk remains until all systems are updated.

Key Points: • Three critical CVEs affect Nextcloud on Fedora: CVE-2026-66010, CVE-2026-65903, and CVE-2026-59883. • Vulnerabilities include XSS attacks and cookie injection risks that could expose sensitive data. • Patches are available, and users are advised to update their systems immediately.