Read the docs
TI-2025-33722 Aliases CVE-2025-53830

Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)

Priority MEDIUM 42CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing application ownCloud. Versions of Anti-Virus for ownCloud before 1.2.3 are vulnerable to Server-Side Request Forgery (SSRF). This corresponds to versions of ownCloud 10 prior to 10.15.3. Upgrade ownCloud 10 to version 10.15.3 or later or upgrade Anti-Virus for ownCloud 10 to version 1.2.3 or later to receive a fix.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00462 40th percentileScored 2026-11-07
Fix Fixed Anti-Virus for ownCloud (owncloud): 1.2.3ownCloud 10 (owncloud): 10.15.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ownCloudAnti-Virus for ownCloudbefore 1.2.31.2.3Patch availableCNA
ownCloudownCloud 10before 10.15.310.15.3Patch availableCNA
  • Anti-Virus for ownCloud VendorownCloud Affected before 1.2.3 Fixed in 1.2.3 Patch available CNA
  • ownCloud 10 VendorownCloud Affected before 10.15.3 Fixed in 10.15.3 Patch available CNA

Remediation

  • Fix · CNA Anti-Virus for ownCloud (owncloud) Fixed in 1.2.3
  • Fix · CNA ownCloud 10 (owncloud) Fixed in 10.15.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53830

References

Other 1

  • TI-2023-26770 An issue was discovered in ownCloud owncloud/core before 10.13.1. KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-26768 An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before… KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-15391 OwnCloud 8.1.8 - Username Disclosure CVSS 4.0MEDIUM 5.3
  • TI-2015-03941 Directory traversal vulnerability in the routing component in ownCloud Server before… CVSS 2.0HIGH 10.0
  • TI-2025-37176 ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the… CVSS 3.1MEDIUM 5.3
  • TI-2023-09745 ownCloud Android app vulnerable to SQL Injection CVSS 3.1MEDIUM 6.2
See all 172 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences