High severity · published Jul 6, 2026
CVE-2025-53829
ownCloud 10 is vulnerable to Relative Path Traversal
8.0
CVSS
0.5%
EPSS
No
On KEV
Description
ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with administrative privileges can exploit a path traversal vulnerability in the system to execute arbitrary code. Upgrade ownCloud 10 to version 10.15.3 or later to receive a patch.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
O1
ownCloud 10 · owncloud
< 10.15.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53829
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53829
github.com
https://github.com/owncloud/security-advisories/security/advisories/GHSA-4439-4wxm-c9px
More from ownCloud 10
9.1
CVE-2025-53830
Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)
8.5
CVE-2025-53828
SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)
8.2
CVE-2025-53831
DrawIO for ownCloud 10 is vulnerable to Stored XSS