The vulnerability is a server‑side request forgery in the SharePoint for ownCloud app integrated with ownCloud Classic. Attackers who have administrative privileges can send crafted requests from the ownCloud server to arbitrary URLs. Because the request originates from the host, the attacker can retrieve internal resources, access the local network, and ultimately trigger code execution on the host machine. The flaw is classified as CWE‑918 and has a CVSS base score of 8.5, indicating high severity. The EPSS score is < 1 %, indicating a very low exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation requires administrative access to ownCloud; once obtained, the SSRF allows the attacker to execute arbitrary code. The absence of public exploitation data suggests limited known attacks, but the and low EPSS for systems with exposed administrative interfaces.

The flaw affects ownCloud SharePoint and ownCloud 10—specifically any installation of SharePoint for ownCloud prior to version 0.4.1 and ownCloud 10 prior to 10.15.3.

The CVSS base score of 8.5 indicates high severity, while an EPSS score of < 1 % suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, so no public exploit signatures have been seen yet. Exploitation requires administrative privilege within ownCloud; after that, the SSRF can be used to send requests to internal or external addresses, potentially allowing arbitrary code execution. The attack is local to the ownCloud server, meaning the exploitable endpoint must be reachable from the server itself. Network controls that restrict outbound traffic or use a web proxy can mitigate the risk, but the most effective defense is to upgrade the application to the fixed version.