What’s Vulnerable › Vulnerabilities

CVE-2020-8180

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-06-08 · updated 2026-06-17
• Weakness: CWE-94

Description

A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.

Affected products

• Nextcloud Talk: before 6.0.5; from 7.0.0 before 7.0.3; from 8.0.0 before 8.0.8 — fixed in 6.0.5, 7.0.3, 8.0.8

How to fix

Upgrade to a fixed version: Nextcloud Talk 6.0.5, 7.0.3, 8.0.8. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/851807
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-021
• https://hackerone.com/reports/851807
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-021

Get alerted when CVE-2020-8180 or the next vulnerability affects your stack