ownCloud vulnerabilities
We track 7 vulnerabilities in ownCloud products across 7 products. 7 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on July 6, 2026.
Latest ownCloud vulnerabilities
- 8.2 High severity
DrawIO for ownCloud: Improper Neutralization of Input During Web Page Generation
DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with ac
- 9.1 Critical severity
Anti-Virus for ownCloud: Server-Side Request Forgery
Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing application ownCloud. Versions of Anti-Virus for ownCloud before 1.2.3 are vulnerable to Server-Side Request Forgery (SSRF). This corresponds to versions of own
- 8.0 High severity
ownCloud 10: Relative Path Traversal
ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with administrative privileges can exploit a path traversal vulnerability in the system to execute arbitrary code. Upgrade ownCloud 10 to
- 8.5 High severity
SharePoint: Server-Side Request Forgery
SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In SharePoint for ownCloud prior to version 0.4.1, which corresponds to ownCloud 10 prior to 10.15.3, an attacker w
- 9.1 Critical severity
ownCloud Core: Exposed Dangerous Method or Function
ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Updater on ownCloud 10 before 10.15.3 has an exposed dangerous method or function. Attackers with admin
- 9.8 Critical severity
ownCloud Improper Authentication Exploited
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs
- 7.5 High severity
ownCloud graphapi Information Disclosure Exploited
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP env