CVE-2025-53827

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-53827", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-07-09T14:14:52.530Z", "datePublished": "2026-07-06T14:31:07.220Z", "dateUpdated": "2026-07-08T03:56:33.632Z"}, "containers": {"cna": {"title": "ownCloud Core: Updater has an exposed dangerous method or function", "problemTypes": [{"descriptions": [{"cweId": "CWE-749", "lang": "en", "description": "CWE-749: Exposed Dangerous Method or Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/owncloud/security-advisories/security/advisories/GHSA-hvcx-ph66-mmvw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/owncloud/security-advisories/security/advisories/GHSA-hvcx-ph66-mmvw"}], "affected": [{"vendor": "owncloud", "product": "ownCloud Core", "versions": [{"version": "< 10.15.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-06T14:39:25.899Z"}, "descriptions": [{"lang": "en", "value": "ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Updater on ownCloud 10 before 10.15.3 has an exposed dangerous method or function. Attackers with administrative privileges may leverage functionality to execute arbitrary code. This issue has been fixed in version 10.15.3."}], "source": {"advisory": "GHSA-hvcx-ph66-mmvw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-07T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-53827"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T03:56:33.632Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "ownCloud Core: Updater has an exposed dangerous method or function", "source": {"advisory": "GHSA-hvcx-ph66-mmvw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "owncloud", "product": "ownCloud Core", "versions": [{"status": "affected", "version": "< 10.15.3"}]}], "references": [{"url": "https://github.com/owncloud/security-advisories/security/advisories/GHSA-hvcx-ph66-mmvw", "name": "https://github.com/owncloud/security-advisories/security/advisories/GHSA-hvcx-ph66-mmvw", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Updater on ownCloud 10 before 10.15.3 has an exposed dangerous method or function. Attackers with administrative privileges may leverage functionality to execute arbitrary code. This issue has been fixed in version 10.15.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-749", "description": "CWE-749: Exposed Dangerous Method or Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-06T14:39:25.899Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-53827", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-07T16:41:57.964422Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-07T16:42:09.629Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-53827", "state": "PUBLISHED", "dateUpdated": "2026-07-06T14:39:25.899Z", "dateReserved": "2025-07-09T14:14:52.530Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-06T14:31:07.220Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ownCloud Core", "vendor": "owncloud", "versions": [{"status": "affected", "version": "< 10.15.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Updater on ownCloud 10 before 10.15.3 has an exposed dangerous method or function. Attackers with administrative privileges may leverage functionality to execute arbitrary code. This issue has been fixed in version 10.15.3."}, {"lang": "es", "value": "ownCloud Core es el componente del lado del servidor de la aplicaci\u00f3n de almacenamiento, sincronizaci\u00f3n y compartici\u00f3n de archivos ownCloud Classic. En versiones anteriores a la 10.15.3, el Actualizador en ownCloud 10 antes de la 10.15.3 tiene un m\u00e9todo o funci\u00f3n peligrosa expuesta. Atacantes con privilegios administrativos pueden aprovechar la funcionalidad para ejecutar c\u00f3digo arbitrario. Este problema ha sido corregido en la versi\u00f3n 10.15.3."}], "id": "CVE-2025-53827", "lastModified": "2026-10-06T22:10:00.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-53827", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-07T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-06T16:16:26.740", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/owncloud/security-advisories/security/advisories/GHSA-hvcx-ph66-mmvw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-749"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.15.3)"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "ownCloud Core", "source": "cna", "vendor": "owncloud"}, "product": "owncloud", "vendor": "owncloud"}], "created": "2026-07-06T22:15:15.524845+00:00", "updated": "2026-08-01T18:45:03.832502+00:00", "vendors": ["owncloud", "owncloud$PRODUCT$owncloud"]}