CVE-2020-8138

MEDIUM 6.5CVE-2020-8138 · Published 20/03/2020 · updated 17/06/2026

In short

CVE-2020-8138 is a MEDIUM (CVSS 6.5) vulnerability affecting nextcloud server (nextcloud).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.4% of all vulnerabilities.
Fix: update to 16.0.7, 17.0.2, 15.0.14 or later.

Package	Affected versions	Patched versions
nextcloud server nextcloud	`≥ 16.0.0, < 16.0.7≥ 17.0.0, < 17.0.2< 15.0.14`	`16.0.717.0.215.0.14`

Description

A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL.

References

hackerone.com/reports/736867 · Exploit
nextcloud.com/security/advisory · Third Party Advisory

More vulnerabilities in nextcloud server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nextcloud server

nextcloud

≥ 16.0.0, < 16.0.7≥ 17.0.0, < 17.0.2< 15.0.14

16.0.717.0.215.0.14

More vulnerabilities in nextcloud server

See all →