CVE-2025-53827

ownCloud Core: Updater has an exposed dangerous method or function

State: Published
Severity: 9.1 Critical
Published: Jul 6, 2026
Updated: Jul 8, 2026
Reserved: Jul 9, 2025

Description

ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Updater on ownCloud 10 before 10.15.3 has an exposed dangerous method or function. Attackers with administrative privileges may leverage functionality to execute arbitrary code. This issue has been fixed in version 10.15.3.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-749 Exposed Dangerous Method or Function

Affected Products

Product	Versions
ownCloud Coreowncloud	< 10.15.3Affected

References

https://github.com/owncloud/security-advisories/security/advisories/GHSA-hvcx-ph66-mmvw

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.