CVE-2025-53827
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In ownCloud Core prior to version 10.15.3, the Updater exposes a dangerous method or function. This allows attackers with administrative privileges to execute arbitrary code on the server.
Risk Assessment
The risk involves potential server takeover by a malicious administrator or after account compromise, leading to full system and data compromise.
Recommendation
Immediately upgrade ownCloud Core to version 10.15.3 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Updater on ownCloud 10 before 10.15.3 has an exposed dangerous method or function. Attackers with administrative privileges may leverage functionality to execute arbitrary code. This issue has been fixed in version 10.15.3.