CVE-2020-8173: Nextcloud Server

Low severity, CVSS 2.2. EPSS: 0.4% chance of exploitation in the next 30 days.

A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.

Affected products

• Nextcloud Nextcloud Server: before 17.0.7 (fixed in 17.0.7); from 18.0.0, before 18.0.5 (fixed in 18.0.5)

Published 2020-11-02. Last modified 2026-06-17.