CVE-2020-8138: Nextcloud Server

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL.

Affected products

• Nextcloud Nextcloud Server: before 15.0.14 (fixed in 15.0.14); from 16.0.0, before 16.0.7 (fixed in 16.0.7); from 17.0.0, before 17.0.2 (fixed in 17.0.2)

Published 2020-03-20. Last modified 2026-06-17.