CVE-2020-8118: Nextcloud Server

Medium severity, CVSS 5.0. EPSS: 1.3% chance of exploitation in the next 30 days.

An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.

Affected products

• Nextcloud Nextcloud Server: before 15.0.9 (fixed in 15.0.9); from 16.0.0, before 16.0.2 (fixed in 16.0.2)
• Novell Suse Linux Enterprise Server: version 12.0 only
• Opensuse Backports Sle: version 15.0 only

Published 2020-02-04. Last modified 2026-06-17.