CVE-2025-53830
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
An SSRF vulnerability in Anti-Virus for ownCloud before version 1.2.3 (and ownCloud 10 before 10.15.3) allows an attacker to send requests from the server to internal network resources. The flaw is due to insufficient URL validation in the antivirus component.
Risk Assessment
The risk includes internal port scanning, access to sensitive data in the internal network, and potential use of the server as a proxy for attacks on other systems. This could lead to information disclosure or attack escalation within the infrastructure.
Recommendation
Immediately upgrade ownCloud 10 to version 10.15.3 or later, or upgrade Anti-Virus for ownCloud 10 to version 1.2.3 or later. After the update, also review firewall configuration to restrict access to internal resources.
Original NVD description (English source)
Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing application ownCloud. Versions of Anti-Virus for ownCloud before 1.2.3 are vulnerable to Server-Side Request Forgery (SSRF). This corresponds to versions of ownCloud 10 prior to 10.15.3. Upgrade ownCloud 10 to version 10.15.3 or later or upgrade Anti-Virus for ownCloud 10 to version 1.2.3 or later to receive a fix.