What’s Vulnerable › Vulnerabilities

CVE-2023-24804: ownCloud Android app vulnerable to Path Traversal

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-13 · updated 2026-06-17
• Weakness: CWE-22

Description

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. The bypasses may lead to information disclosure when uploading the app’s internal files, and to arbitrary file write when uploading plain text files (although limited by the .txt extension). Version 3.0 fixes the reported bypasses.

Affected products

• Owncloud Client: before 3.0.0 — fixed in 3.0.0

How to fix

Upgrade to a fixed version: Owncloud Client 3.0.0. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/377107
• https://owncloud.com/security-advisories/oc-sa-2023-001/
• https://securitylab.github.com/advisories/GHSL-2022-059_GHSL-2022-060_Owncloud_Android_app/
• https://hackerone.com/reports/377107
• https://owncloud.com/security-advisories/oc-sa-2023-001/
• https://securitylab.github.com/advisories/GHSL-2022-059_GHSL-2022-060_Owncloud_Android_app/

Get alerted when CVE-2023-24804 or the next vulnerability affects your stack