What is the CVSS score of CVE-2025-53828?

CVE-2025-53828 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Owncloud are affected by CVE-2025-53828?

The SharePoint for ownCloud app (versions before 0.4.1) contains a server-side request forgery vulnerability enabling authenticated administrators to execute arbitrary code on the host system, with…. A patch is available.

How to fix or mitigate CVE-2025-53828?

24 hours: Identify all ownCloud deployments and confirm whether SharePoint for ownCloud app is in use. 7 days: Upgrade to SharePoint for ownCloud app version 0.4.1 or later and ownCloud 10 to version 10.15.3 or later; restrict administrator access to SharePoint features if patching cannot complete immediately. 30 days: Audit logs to verify all instances are patched; review and restrict administrator access as needed.

Owncloud CVE-2025-53828

EUVD-2025-210432 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-06 GitHub_M

RCE SSRF Microsoft Owncloud Sharepoint Owncloud 10

8.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 06, 2026 - 17:01 EUVD

Analysis Generated

Jul 06, 2026 - 16:38 vuln.today

CVE Published

Jul 06, 2026 - 14:41 cve.org

HIGH 8.5

DescriptionCVE.org

SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In SharePoint for ownCloud prior to version 0.4.1, which corresponds to ownCloud 10 prior to 10.15.3, an attacker with administrative privileges can use a SSRF vulnerability in the SharePoint app to execute arbitrary code on the system. Upgrade ownCloud 10 to version 10.15.3 or later to receive SharePoint for ownCloud 0.4.1, the fixed version.

AnalysisAI

Server-side request forgery escalating to remote code execution in the SharePoint for ownCloud app (versions prior to 0.4.1, bundled with ownCloud 10 before 10.15.3) lets an already-authenticated administrator coerce the server into making attacker-controlled requests that ultimately run arbitrary code on the host. The flaw is tagged RCE/SSRF and carries an 8.5 CVSS with a scope change (S:C), reflecting that abuse of the SharePoint integration crosses a trust boundary into the underlying system. No public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-and-move-on issue rather than an active-threat emergency.