HackerOne Disclosed Reports - 2026-08-23

Medium
resolved

Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider

Bug reported by Michael Liu was disclosed at August 24, 2026, 1:23 am   |   Path Traversal

A vulnerability in Nextcloud Talk Android allowed an external Android app to write and retrieve config files by pinging an internal endpoint.