CVE-2025-53827 ownCloud Core: Updater has an exposed dangerous method or function
Administrators can execute arbitrary code via exposed dangerous methods in the ownCloud Core Updater component.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-53827?
CVE-2025-53827 is a critical code injection vulnerability in ownCloud Core, published on 6 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Updater on ownCloud 10 before 10.15.3 has an exposed dangerous method or function. Attackers with administrative privileges may leverage functionality to execute arbitrary code. This issue has been fixed in version 10.15.3.
Weakness: CWE-749
Which versions are affected by CVE-2025-53827?
How do I fix CVE-2025-53827?
No fix has been published for CVE-2025-53827 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-53827 being exploited?
There is no known exploitation of CVE-2025-53827 in the wild and no public exploit code.