The Updater component of ownCloud Core, for versions before 10.15.3, contains an exposed method that can be invoked by users with administrative privileges. When called, this method allows an attacker to execute arbitrary code on the server. The flaw falls under CWE‑749, describing a method or function that is exposed for unauthorized use, leading to remote code execution. Because the attacker must possess admin rights, the impact is limited to users who manage the server, but once exploited they can compromise data confidentiality, integrity, and availability of the entire ownCloud instance.

ownCloud Core, the server‑side part of the file storage and synchronization application ownCloud Classic, is affected in every release before version 10.15.3. Administrators running ownCloud 10.0 up to 10.15.2 are vulnerable, regardless of the minor release number.

The CVSS base score of 9.1 classifies the issue as critical, indicating that the exposed method can be used for full remote code execution. The EPSS score is reported as less than one percent, suggesting that at present the probability of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would still need administrative access, so the actual attack vector is likely an HTTP request that invokes the updater endpoint from a session that has been granted admin rights. The low EPSS score does not negate the need for remediation, because any administrator that could be compromised or misconfigured could be abused to gain full server access.