CVE-2021-41180

Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only affected users of the Android Talk client. It is recommended that the Nextcloud Talk App is upgraded to 12.1.2. There are no known workarounds.

• CWE-601

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4fxr-mrw2-cq92Issue Tracking, Third Party Advisory
• https://github.com/nextcloud/spreed/pull/6239Patch, Third Party Advisory
• https://hackerone.com/reports/1337178Exploit, Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4fxr-mrw2-cq92Issue Tracking, Third Party Advisory
• https://github.com/nextcloud/spreed/pull/6239Patch, Third Party Advisory
• https://hackerone.com/reports/1337178Exploit, Patch, Third Party Advisory

Published

Mar 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41175Pi-hole's Web interface (based on AdminLTE) provides a centr…5.4
• CVE-2021-41176Pterodactyl is an open-source game server management panel b…4.3
• CVE-2021-41177Nextcloud is an open-source, self-hosted productivity platfo…8.1
• CVE-2021-41178Nextcloud is an open-source, self-hosted productivity platfo…6.5
• CVE-2021-41179Nextcloud is an open-source, self-hosted productivity platfo…6.5
• CVE-2021-4118pytorch-lightning is vulnerable to Deserialization of Untrus…7.8
• CVE-2021-41181Nextcloud talk is a self hosting messaging service. In versi…2.4
• CVE-2021-41182jQuery-UI is the official jQuery user interface library. Pri…6.1
• CVE-2021-41183jQuery-UI is the official jQuery user interface library. Pri…6.1
• CVE-2021-41184jQuery-UI is the official jQuery user interface library. Pri…6.1
• CVE-2021-41185Mycodo is an environmental monitoring and regulation system.…6.5
• CVE-2021-41186Fluentd collects events from various data sources and writes…7.5