Executive brief
ownCloud is a file storage and sharing platform used by organizations to manage and sync data. A security flaw allows a user with administrative access to bypass directory restrictions and execute unauthorized commands on the underlying server. This could lead to a complete system takeover, data theft, or service disruption, though it requires high-level access to initiate.
Technical details
A relative path traversal vulnerability (CWE-23) exists in ownCloud 10 prior to version 10.15.3. The system fails to properly neutralize path sequences (such as '..') in external input used to construct file paths. An attacker with administrative privileges can exploit this to access restricted directories and achieve remote code execution (RCE). While the attack vector is network-based, the complexity is rated as high and requires high-level privileges. The issue is resolved in version 10.15.3.
Affected products
- ownCloud ownCloud 10 < 10.15.3
Timeline
- 2026-06-24: advisory: Vendor advisory published via GitHub
- 2026-07-06: disclosed: CVE published to NVD