# CVE-2016-7102: ownCloud Desktop arbitrary code execution via Trojan library

Source: https://junglewise.ai/threats/cve-2016-7102-owncloud-desktop-arbitrary-code-execution-via-trojan-library  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-7102 · Severity: high · CVSS 8.4 · Published 2017-01-23

ownCloud Desktop is a file synchronization application used to manage and share corporate data. A security flaw in older versions allows a local user to place a malicious file in a specific location on the computer's hard drive, which the application then executes. This could allow an attacker to take full control of the system, access sensitive files, or escalate their privileges.

Vendors: [ownCloud](https://junglewise.ai/threats/vendors/owncloud).

## Quick answers

**Is CVE-2016-7102 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-7102 being exploited in the wild.

**How severe is CVE-2016-7102?** High severity, with a CVSS score of 8.4, published 23 January 2017.

**Which products and versions are affected?** ownCloud ownCloud Desktop Before 2.2.3.

**Is there a fix for CVE-2016-7102?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-7102 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2016-7102?** Check whether you run Owncloud Desktop Client. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A DLL hijacking or insecure library loading vulnerability exists in ownCloud Desktop versions prior to 2.2.3. The application attempts to load a library from a 'special path' on the C: drive without sufficient validation, allowing a local attacker to place a malicious 'Trojan' library in that location. Because the application may run with elevated permissions or be used by multiple users, this can lead to arbitrary code execution and local privilege escalation. The attack requires local access to the file system but no specific user interaction or prior authentication within the app. The issue is resolved in version 2.2.3.

## Affected products

- ownCloud ownCloud Desktop Before 2.2.3

## Timeline

- 2016-08-24: disclosed: Initial disclosure via SecurityFocus (BID 92627)
- 2017-01-23: advisory: NVD publication date

## References

- [http://www.securityfocus.com/bid/92627](http://www.securityfocus.com/bid/92627)
- [https://owncloud.org/security/advisory/?id=oc-sa-2016-016](https://owncloud.org/security/advisory/?id=oc-sa-2016-016)