Owncloud vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Owncloud flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2023-49105 ownCloud Improper AuthenticationExploited since Aug 27, 2026 · CVSS 9.8
• CVE-2023-49103 ownCloud graphapi Information DisclosureExploited since Nov 30, 2023 · CVSS 10

Latest high and critical flaws

• CVE-2025-53831 DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic.High 8.2 · Jul 6, 2026
• CVE-2025-53830 Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing application ownCloud.Critical 9.1 · Jul 6, 2026
• CVE-2025-53829 ownCloud is a file storage, synchronization, and sharing application.High 8 · Jul 6, 2026
• CVE-2025-53828 SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic.High 8.5 · Jul 6, 2026
• CVE-2025-53827 ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic.Critical 9.1 · Jul 6, 2026
• CVE-2023-49105 ownCloud Improper AuthenticationExploited · Critical 9.8 · Nov 21, 2023
• CVE-2023-49104 An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled.High 8.7 · Nov 21, 2023
• CVE-2023-49103 ownCloud graphapi Information DisclosureExploited · Critical 10 · Nov 21, 2023
• CVE-2022-31649 ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.High 7.5 · Jun 9, 2022
• CVE-2021-44537 ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution.High 7.8 · Jan 15, 2022
• CVE-2021-33828 The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploaded to a public share)High 8.8 · Jan 15, 2022
• CVE-2021-33827 The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings.High 7.2 · Jan 15, 2022
• CVE-2021-35946 A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permiCritical 9.8 · Sep 7, 2021
• CVE-2020-28646 ownCloud owncloud/client before 2.7 allows DLL Injection.High 7.8 · Feb 26, 2021
• CVE-2020-36249 The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares.High 7.5 · Feb 19, 2021
• CVE-2020-10252 An issue was discovered in ownCloud before 10.4.High 8.3 · Feb 19, 2021
• CVE-2020-28645 Deleting users with certain names caused system files to be deleted.Critical 9.1 · Feb 9, 2021
• CVE-2014-2052 Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or Critical 9.8 · Feb 11, 2020
• CVE-2014-2048 The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation.Critical 9.8 · Mar 26, 2018
• CVE-2016-7102 ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special path" in the C: driveHigh 8.4 · Jan 23, 2017
• CVE-2016-1499 ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listHigh 8.5 · Jan 8, 2016
• CVE-2015-7699 The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to instantiate arbitrary clHigh 9 · Oct 26, 2015
• CVE-2015-6500 Directory traversal vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possibHigh 7.5 · Oct 26, 2015
• CVE-2015-7698 icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the (1) listShHigh 9 · Oct 21, 2015
• CVE-2015-4718 The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitraHigh 9 · Oct 21, 2015