CVE-2020-8180: Nextcloud Talk

Critical severity, CVSS 9.9. EPSS: 1.7% chance of exploitation in the next 30 days.

A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.

Affected products

• Nextcloud Talk: before 6.0.5 (fixed in 6.0.5); from 7.0.0, before 7.0.3 (fixed in 7.0.3); from 8.0.0, before 8.0.8 (fixed in 8.0.8)

Published 2020-06-08. Last modified 2026-06-17.