Due to a incorrect usage of the getOwner
function of the ownCloud virtual filesystem,done authenticated users with incoming shares of other users are able to access files beginning with “.v” of the sharing user. This can only be exploited if the “files_versions” application is enabled on the server.
For more information please consult the official advisory.
This advisory is licensed CC BY-SA 4.0