Improper Validation in the User's Avatar Mechanism - ownCloud

Improper Validation in the User’s Avatar Mechanism may allow an authenticated attacker to edit their own profile in a way that consumes a substantial amount of resources, creating a Denial of Service...

Reflected XSS in login page forgot password functionallity

The login page was not properly sanitizing exception messages from the ownCloud server...

Code execution in /lib/migrate.php - ownCloud

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows authenticated remote attackers to execute arbitrary code by uploading a crafted mount.php file in an imported ZIP file. Affected Software ownCloud Server 4.0.10 CVE-2013-5665 ownCloud Server 4.5.5 CVE-2013-5665...

Bypass of application specific PIN

The ownCloud Android application does support setting a PIN that has to be provided before the application can be opened. An attacker may remove the PIN by clearing the application data via the Android system settings. By doing that the application information would be removed while the...

Server: Users can mount the local filesystem

Due to an insufficient permission check authenticated users are able to access preview pictures of others users. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Server: Multiple XSS

Multiple stored and reflected XSS have been adressed. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Security Notice: Impact of CVE-2026-33634 on ownCloud Build Infrastructure - ownCloud

No customer data was compromised. No source code was altered. The attack affected our build infrastructure only – specifically the systems that produce container images and client binaries. If you are using a build before March 19th, no action is needed If you are using ocis-rolling image conta...

Improper access control in SVG preview generation - ownCloud

Improper access control in SVG preview generation may allow an authenticated attacker to gain access to other user’s images...

URL manipulation when sharing files via email - ownCloud

Improper handling of URL in sharing notification may allow an authenticated attacker to send an email to another user containing a potentially malicious URL...