Description
A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Nextcloud Contact | 3.3.0 | — |
Unscored
CVE-2020-8181
EUVD-2020-29062GHSA-wgmx-fv9q-wpfx
A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.
Published Jul 10, 2020 · Updated Aug 4, 2024 · Assigned by hackerone