Path traversal allows tricking the Talk Android app into writing files into it's root directory
Priority LOW 36CWE-22Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. Prior to version 17.0.0, an unprotected intend allowed malicious third party apps to trick the Talk Android app into writing files outside of its intended cache directory. Nextcloud Talk Android version 17.0.0 has a patch for this issue. No known workarounds are available.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 17.0.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | before 17.0.0 | 17.0.0 | Patch available | CNA |
- security-advisories Vendornextcloud Affected before 17.0.0 Fixed in 17.0.0 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:talk:*:*:*:*:*:android:*:* | before 17.0.0 | Vulnerable | nextcloud |
| cpe:2.3:a:nextcloud:talk:17.0.0:rc1:*:*:*:android:*:* | 17.0.0 rc1 | Vulnerable | nextcloud |
| cpe:2.3:a:nextcloud:talk:17.0.0:rc2:*:*:*:android:*:* | 17.0.0 rc2 | Vulnerable | nextcloud |
| cpe:2.3:a:nextcloud:talk:17.0.0:rc3:*:*:*:android:*:* | 17.0.0 rc3 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:talk:*:*:*:*:*:android:*:* Versions before 17.0.0 Vulnerable ·nextcloud
- cpe:2.3:a:nextcloud:talk:17.0.0:rc1:*:*:*:android:*:* Versions 17.0.0 rc1 Vulnerable ·nextcloud
- cpe:2.3:a:nextcloud:talk:17.0.0:rc2:*:*:*:android:*:* Versions 17.0.0 rc2 Vulnerable ·nextcloud
- cpe:2.3:a:nextcloud:talk:17.0.0:rc3:*:*:*:android:*:* Versions 17.0.0 rc3 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 17.0.0
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39957
References
More nextcloud Talk vulnerabilities
- TI-2022-08697 Open Redirect in Nextcloud Talk CVSS 3.1MEDIUM 6.1
- TI-2021-18019 Geolocation preview links can be set to arbitrary links in nextcloud talk CVSS 3.1MEDIUM 6.1
- TI-2023-24170 Password of talk conversations can be bruteforced in Nextcloud CVSS 3.1MEDIUM 4.3
- TI-2022-08700 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk CVSS 3.1MEDIUM 4.3
- TI-2020-06598 Code injection in Nextcloud Talk CVSS 3.1CRITICAL 9.9
- TI-2023-08722 Passcode bypass on Talk-Android app CVSS 3.1LOW 2.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences