Owncloud vulnerabilities

Products

• Owncloud 119
• Server 108
• Client 7
• Desktop Client 5
• 10 4
• Files Antivirus 3
• Android 2

Newest

• owncloud drawio for owncloud, 10 +1 more DrawIO for ownCloud 10 is vulnerable to Stored XSS CVE-2025-53831 8.2 HighJuly 6, 2026
• owncloud anti-virus for owncloud, 10 +1 more Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF) CVE-2025-53830 9.1 CriticalJuly 6, 2026
• owncloud 10 ownCloud 10 is vulnerable to Relative Path Traversal CVE-2025-53829 8.0 HighJuly 6, 2026
• microsoft sharepoint, owncloud 10 +1 more SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF) CVE-2025-53828 8.5 HighJuly 6, 2026
• owncloud core ownCloud Core: Updater has an exposed dangerous method or function CVE-2025-53827 9.1 CriticalJuly 6, 2026
• kiteworks owncloud OwnCloud 8.1.8 - Username Disclosure CVE-2019-25337 5.3 MediumFebruary 12, 2026
• owncloud guests ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests... CVE-2025-59716 5.3 MediumNovember 5, 2025
• owncloud anroid apk An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate... CVE-2024-50657 Public exploit 6.8 MediumNovember 22, 2024
• owncloud, owncloud server +1 more An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify,... CVE-2023-49105 In KEVPublic exploit EPSS 43.2% 9.8 CriticalNovember 21, 2023
• owncloud oauth2 An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is... CVE-2023-49104 8.7 HighNovember 21, 2023
• owncloud graphapi, graph api +1 more An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.... CVE-2023-49103 In KEVPublic exploit EPSS 77.8% 10.0 CriticalNovember 21, 2023
• google android, owncloud client +1 more ownCloud Android app vulnerable to SQL Injection CVE-2023-23948 6.2 MediumFebruary 13, 2023
• google android, owncloud client +1 more ownCloud Android app vulnerable to Path Traversal CVE-2023-24804 5.0 MediumFebruary 13, 2023
• owncloud The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the... CVE-2022-43679 4.2 MediumNovember 10, 2022
• owncloud ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or... CVE-2022-31649 7.5 HighJune 9, 2022
• owncloud client ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers. CVE-2022-25339 5.5 MediumApril 7, 2022
• owncloud client ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate... CVE-2022-25338 6.8 MediumApril 7, 2022
• owncloud files antivirus The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the... CVE-2021-33827 7.2 HighJanuary 15, 2022
• owncloud files antivirus The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by... CVE-2021-33828 8.8 HighJanuary 15, 2022
• owncloud desktop client, fedoraproject fedora +1 more ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop... CVE-2021-44537 Fix available 7.8 HighJanuary 15, 2022
• owncloud user ldap Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the... CVE-2021-40537 2.7 LowSeptember 8, 2021
• owncloud Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows... CVE-2021-35948 5.4 MediumSeptember 7, 2021
• owncloud A receiver of a federated share with access to the database with ownCloud version before 10.8... CVE-2021-35946 9.8 CriticalSeptember 7, 2021
• owncloud The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the... CVE-2021-35949 5.3 MediumSeptember 7, 2021
• owncloud The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker... CVE-2021-35947 5.3 MediumSeptember 7, 2021
• owncloud server ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information... CVE-2021-29659 6.5 MediumMay 20, 2021
• owncloud desktop client ownCloud owncloud/client before 2.7 allows DLL Injection. The desktop client loaded development... CVE-2020-28646 7.8 HighFebruary 26, 2021
• owncloud client The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN... CVE-2020-36248 3.9 LowFebruary 19, 2021
• owncloud file firewall The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type... CVE-2020-36249 7.5 HighFebruary 19, 2021
• owncloud client In the ownCloud application before 2.15 for Android, the lock protection mechanism can be... CVE-2020-36250 6.1 MediumFebruary 19, 2021
• owncloud ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a... CVE-2020-36251 3.5 LowFebruary 19, 2021
• owncloud server ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim,... CVE-2020-36252 6.8 MediumFebruary 19, 2021
• owncloud An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps... CVE-2020-10252 8.3 HighFebruary 19, 2021
• owncloud An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a... CVE-2020-10254 5.9 MediumFebruary 19, 2021
• owncloud Deleting users with certain names caused system files to be deleted. Risk is higher for systems... CVE-2020-28645 9.1 CriticalFebruary 9, 2021
• owncloud The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie... CVE-2020-28644 4.3 MediumFebruary 9, 2021
• owncloud files antivirus When using an object storage like S3 as the file store, when a user creates a public link to a... CVE-2020-16144 5.7 MediumFebruary 9, 2021
• owncloud ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.' CVE-2020-16255 Fix available 6.1 MediumJanuary 15, 2021
• owncloud, owncloud server +1 more Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote... CVE-2014-2052 9.8 CriticalFebruary 11, 2020
• owncloud, owncloud server +1 more Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before... CVE-2014-2050 6.5 MediumJanuary 23, 2020
• owncloud, owncloud server +1 more Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow... CVE-2013-0203 5.4 MediumNovember 22, 2019
• kiteworks owncloud, owncloud server +1 more Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote... CVE-2013-0202 6.1 MediumNovember 22, 2019
• owncloud The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by... CVE-2014-2048 9.8 CriticalMarch 26, 2018
• owncloud Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated... CVE-2014-1665 Public exploit 5.4 MediumMarch 20, 2018
• owncloud An attacker is logged in as a normal user and can somehow make admin to delete shared folders in... CVE-2017-9340 6.5 MediumJuly 17, 2017
• owncloud A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for... CVE-2017-9339 5.3 MediumJuly 17, 2017
• owncloud Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2... CVE-2017-9338 5.4 MediumJuly 17, 2017
• owncloud ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2... CVE-2017-8896 6.1 MediumJuly 17, 2017
• nextcloud server, owncloud +1 more Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from... CVE-2016-9468 5.3 MediumMarch 28, 2017
• nextcloud server, owncloud +1 more Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from... CVE-2016-9467 5.3 MediumMarch 28, 2017
• Show olderLoading…