CVE-2020-8281

EPSS 0.6%CWE-79

A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting (XSS) attacks.

Affected products

n/a · Nextcloud Contacts

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://hackerone.com/reports/894876 https://nextcloud.com/security/advisory/?id=NC-SA-2020-045