Vulnerability · Published Jul 6, 2026 · Assigned by GitHub_M

CVE-2025-53828SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)

High 8.5

In plain English

A high-severity server-side request forgery in ownCloud 10 from owncloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.4%top 66.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In SharePoint for ownCloud prior to version 0.4.1, which corresponds to ownCloud 10 prior to 10.15.3, an attacker with administrative privileges can use a SSRF vulnerability in the SharePoint app to execute arbitrary code on the system. Upgrade ownCloud 10 to version 10.15.3 or later to receive SharePoint for ownCloud 0.4.1, the fixed version.

Affected products (as reported)

Vendor	Product	Versions
owncloud	SharePoint	< 0.4.1
owncloud	ownCloud 10	< 10.15.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/owncloud/security-advisories/security/advisories/GHSA-4m66-rpfj-m5f6 x_refsource_CONFIRM