CVE-2023-39957

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. Prior to version 17.0.0, an unprotected intend allowed malicious third party apps to trick the Talk Android app into writing files outside of its intended cache directory. Nextcloud Talk Android version 17.0.0 has a patch for this issue. No known workarounds are available.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 17.0.0
nextcloud	talk	< 17.0.0

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-36f7-93f3-mcfjPatch, Vendor Advisory
https://github.com/nextcloud/talk-android/pull/3064Patch
https://hackerone.com/reports/1997029Issue Tracking, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-36f7-93f3-mcfjPatch, Vendor Advisory
https://github.com/nextcloud/talk-android/pull/3064Patch
https://hackerone.com/reports/1997029Issue Tracking, Third Party Advisory

Timeline

Published: Aug 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-399585.3Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.1 CVE-2023-399595.3Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9 CVE-2023-39964.8The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and i CVE-2023-399607.5Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 2 CVE-2023-399614.3Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9 CVE-2023-399627.7Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.1 CVE-2023-399637.8Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.1 CVE-2023-399647.51Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker t CVE-2023-399654.31Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arb CVE-2023-399669.81Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability co CVE-2023-3996710.0WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fie CVE-2023-399686.1jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Se