Executive brief
DrawIO for ownCloud is an integration that allows users to create and edit diagrams within the ownCloud file storage platform. A security flaw allows an attacker to inject malicious scripts into diagrams that, when viewed by other users, could lead to unauthorized data access or account takeover. Organizations using ownCloud 10 should update their software or the DrawIO application to the latest versions to prevent this risk.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the DrawIO application for ownCloud Classic. The flaw is caused by improper neutralization of user-controllable input during web page generation (CWE-79). An authenticated attacker with access to the DrawIO app can upload or modify a diagram containing malicious scripts. When a victim views the affected diagram, the script executes in their browser context, potentially allowing the attacker to steal session cookies or perform actions on behalf of the victim. The issue is resolved in DrawIO for ownCloud version 1.0.2 and ownCloud Classic version 10.15.3.
Affected products
- ownCloud DrawIO for ownCloud 10 < 1.0.2
- ownCloud ownCloud Classic < 10.15.3
Timeline
- 2026-06-24: advisory: Initial disclosure by ownCloud security team
- 2026-07-06: disclosed: NVD publication date