Owncloud
137 CVEs across 18 Owncloud products. Browse Owncloud vulnerabilities, severities, and proof-of-concept exploits.
Owncloud products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53831 | High | 8.2 | 2026-07-06 | DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud… |
CVE-2025-53830 | Critical | 9.1 | 2026-07-06 | Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing application ownCloud. Versions of Anti-Virus for ownCloud b… |
CVE-2025-53829 | High | 8.0 | 2026-07-06 | ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with administrative privileges can e… |
CVE-2025-53828 | High | 8.5 | 2026-07-06 | SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In SharePoint… |
CVE-2025-53827 | Critical | 9.1 | 2026-07-06 | ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Up… |
CVE-2019-25337 | Critical | 9.8 | 2026-02-12 | OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user accounts by manipulating the share.php endpoint. Att… |
CVE-2025-59716 | Medium | 5.3 | 2025-11-05 | ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validatio… |
CVE-2023-49105 | Critical | 9.8 | 2023-11-21 | An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of… |
CVE-2023-49104 | High | 8.7 | 2023-11-21 | An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that… |
CVE-2023-49103 | Critical | 10.0 | 2023-11-21 | An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php librar… |
CVE-2023-24804 | Medium | 5.0 | 2023-02-13 | The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path tra… |
CVE-2023-23948 | Medium | 6.2 | 2023-02-13 | The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL in… |
CVE-2022-43679 | Medium | 4.2 | 2022-11-10 | The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless. This could be abused to spoof th… |
CVE-2022-31649 | High | 7.5 | 2022-06-09 | ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer. |
CVE-2022-25339 | Medium | 5.5 | 2022-04-07 | ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers. |
CVE-2022-25338 | Medium | 6.8 | 2022-04-07 | ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers. |
CVE-2021-44537 | High | 7.8 | 2022-01-15 | ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution. |
CVE-2021-33828 | High | 8.8 | 2022-01-15 | The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploaded to a public share… |
CVE-2021-33827 | High | 7.2 | 2022-01-15 | The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings. |
CVE-2021-40537 | Low | 2.7 | 2021-09-08 | Server Side Request Forgery (SSRF) vulnerability exists in owncloud/user_ldap < 0.15.4 in the settings of the user_ldap app. Administration role is necessary f… |
CVE-2021-35948 | Medium | 5.4 | 2021-09-07 | Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can for… |
CVE-2021-35946 | Critical | 9.8 | 2021-09-07 | A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own perm… |
CVE-2021-35949 | Medium | 5.3 | 2021-09-07 | The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about… |
CVE-2021-35947 | Medium | 5.3 | 2021-09-07 | The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share b… |
CVE-2021-29659 | Medium | 6.5 | 2021-05-20 | ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker c… |
CVE-2020-28646 | High | 7.8 | 2021-02-26 | ownCloud owncloud/client before 2.7 allows DLL Injection. The desktop client loaded development plugins from certain directories when they were present. |
CVE-2020-36248 | Low | 3.9 | 2021-02-19 | The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass th… |
CVE-2020-36252 | Medium | 6.8 | 2021-02-19 | ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a p… |
CVE-2020-36251 | Low | 3.5 | 2021-02-19 | ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share. |
CVE-2020-36250 | Medium | 6.1 | 2021-02-19 | In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past. |
CVE-2020-36249 | High | 7.5 | 2021-02-19 | The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares. |
CVE-2020-10254 | Medium | 5.9 | 2021-02-19 | An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview. |
CVE-2020-10252 | High | 8.3 | 2021-02-19 | An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps/files_sharing/external remote parameter), an authenticated attacker can… |
CVE-2020-28645 | Critical | 9.1 | 2021-02-09 | Deleting users with certain names caused system files to be deleted. Risk is higher for systems which allow users to register themselves and have the data dire… |
CVE-2020-28644 | Medium | 4.3 | 2021-02-09 | The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints. This affects ownC… |
CVE-2020-16144 | Medium | 5.7 | 2021-02-09 | When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files, and another user… |
CVE-2020-16255 | Medium | 6.1 | 2021-01-15 | ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.' |
CVE-2015-4715 | Medium | 4.9 | 2020-02-17 | The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox s… |
CVE-2014-2052 | Critical | 9.8 | 2020-02-11 | Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or… |
CVE-2014-2050 | Medium | 6.5 | 2020-01-23 | Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of… |
CVE-2013-0202 | Medium | 6.1 | 2019-12-17 | Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action p… |
CVE-2013-0203 | Medium | 5.4 | 2019-11-22 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via th… |
CVE-2014-2048 | Critical | 9.8 | 2018-03-26 | The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation. |
CVE-2014-1665 | Medium | 5.4 | 2018-03-20 | Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of… |
CVE-2017-9340 | Medium | 6.5 | 2017-07-17 | An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2. |
CVE-2017-9339 | Medium | 5.3 | 2017-07-17 | A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to… |
CVE-2017-9338 | Medium | 5.4 | 2017-07-17 | Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before… |
CVE-2017-8896 | Medium | 6.1 | 2017-07-17 | ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url… |
CVE-2016-9468 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed… |
CVE-2016-9467 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files… |
CVE-2016-9466 | Medium | 6.1 | 2017-03-28 | Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly… |
CVE-2016-9465 | Medium | 5.4 | 2017-03-28 | Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality… |
CVE-2016-9463 | High | 8.1 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud inclu… |
CVE-2016-9462 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Ne… |
CVE-2016-9461 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was… |
CVE-2016-9460 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app w… |
CVE-2016-9459 | Medium | 6.1 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download… |
CVE-2017-5867 | Medium | 6.5 | 2017-03-03 | ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (s… |
CVE-2017-5866 | Medium | 4.3 | 2017-03-03 | The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows rem… |
CVE-2017-5865 | Low | 3.7 | 2017-03-03 | The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error message… |
CVE-2016-7102 | High | 8.4 | 2017-01-23 | ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special path" in the C: driv… |
CVE-2016-5876 | Medium | 5.9 | 2017-01-23 | ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via a direct request. |
CVE-2016-7419 | Medium | 5.4 | 2016-09-17 | Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remot… |
CVE-2016-1501 | Medium | 4.3 | 2016-01-08 | ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the… |
CVE-2016-1500 | Low | 3.1 | 2016-01-08 | ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file_versions" application is enabled, does not prope… |
CVE-2016-1499 | High | 8.5 | 2016-01-08 | ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory lis… |
CVE-2016-1498 | Medium | 6.1 | 2016-01-08 | Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and… |
CVE-2015-5955 | | 2015-10-29 | ownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which might allow remote instance administrators to obtain sensitive c… | |
CVE-2015-7699 | | 2015-10-26 | The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to instantiate arbitrary c… | |
CVE-2015-7298 | | 2015-10-26 | ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be i… | |
CVE-2015-6670 | | 2015-10-26 | ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated user… | |
CVE-2015-6500 | | 2015-10-26 | Directory traversal vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possi… | |
CVE-2015-4456 | | 2015-10-26 | ownCloud Desktop Client before 1.8.2 does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which allows man-in-the-middle attacke… | |
CVE-2015-7698 | | 2015-10-21 | icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the (1) listS… | |
CVE-2015-5954 | | 2015-10-21 | The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value… | |
CVE-2015-4718 | | 2015-10-21 | The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitr… | |
CVE-2015-4717 | | 2015-10-21 | The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast… | |
CVE-2015-4716 | | 2015-10-21 | Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4, when running on Windows, allows remote attac… | |
CVE-2015-5953 | | 2015-10-21 | Cross-site scripting (XSS) vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users t… | |
CVE-2015-3013 | | 2015-05-08 | ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files… | |
CVE-2015-3012 | | 2015-05-08 | Multiple cross-site scripting (XSS) vulnerabilities in WebODF before 0.5.5, as used in ownCloud, allow remote attackers to inject arbitrary web script or HTML… | |
CVE-2015-3011 | | 2015-05-08 | Multiple cross-site scripting (XSS) vulnerabilities in the contacts application in ownCloud Server Community Edition before 5.0.19, 6.x before 6.0.7, and 7.x b… | |
CVE-2014-9049 | | 2015-02-04 | The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote authenticated users to obtain all valid session IDs via an uns… | |
CVE-2014-9048 | | 2015-02-04 | The documents application in ownCloud Server 6.x before 6.0.6 and 7.x before 7.0.3 allows remote attackers to bypass the password-protection for shared files v… | |
CVE-2014-9047 | | 2015-02-04 | Multiple unspecified vulnerabilities in the preview system in ownCloud 6.x before 6.0.6 and 7.x before 7.0.3 allow remote attackers to read arbitrary files via… | |
CVE-2014-9046 | | 2015-02-04 | The OC_Util::getUrlContent function in ownCloud Server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to read arbitrary files vi… | |
CVE-2014-9045 | | 2015-02-04 | The FTP backend in user_external in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements v… | |
CVE-2014-9044 | | 2015-02-04 | Asset Pipeline in ownCloud 7.x before 7.0.3 uses an MD5 hash of the absolute file paths of the original CSS and JS files as the name of the concatenated file… | |
CVE-2014-9043 | | 2015-02-04 | The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass… | |
CVE-2014-9042 | | 2015-02-04 | Cross-site scripting (XSS) vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7… | |
CVE-2014-9041 | | 2015-02-04 | The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, w… | |
CVE-2014-5341 | | 2015-02-04 | The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obta… | |
CVE-2014-2044 | | 2014-10-06 | Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended acc… | |
CVE-2014-4929 | | 2014-08-20 | Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execu… | |
CVE-2014-2051 | | 2014-06-05 | ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using… | |
CVE-2013-0304 | | 2014-06-05 | ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid… | |
CVE-2013-0302 | | 2014-06-05 | Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors related to "inclusio… | |
CVE-2014-3963 | | 2014-06-04 | ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified… | |
CVE-2014-3838 | | 2014-06-04 | ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which allows remote authenticated users to read the names of files of… | |
CVE-2014-3837 | | 2014-06-04 | The document application in ownCloud Server before 6.0.3 uses sequential values for the file_id, which allows remote authenticated users to enumerate shared fi… |