Anti‑Virus for ownCloud is a plugin that scans files for malware in the ownCloud 10 file‑storage platform. Versions of the plugin before 1.2.3 contain a Server‑Side Request Forgery flaw that allows an adversary to cause the server to issue arbitrary HTTP or HTTPS requests to internal or external hosts. The vulnerability is classified under CWE-918 and can potentially be used to access resources the server has connectivity to; the base score of 9.1 indicates a severe risk, but the EPSS noted as less than 1%, suggesting a very low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog, meaning no publicly disclosed exploits exist yet. The likely attack vector is inferred to involve triggering a file‑scan operation—such as uploading a file or invoking an API endpoint that constructs the malicious request. Because the description does not detail specific data disclosures, the actual impact is limited to the ability to contact arbitrary hosts from the server’s network.

All deployments running ownCloud 10 with the anti‑virus plugin version earlier than 1.2.3 are affected, version .3. Versions equal to or newer than 1.2.3 for the plugin or 10.15.3 for ownCloud are not impacted.

The CVSS score of 9.1 indicates a severe risk. The EPSS score of less than 1% reflects a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, so no public exploits are known. Based on the description, the likely attack vector involves an authenticated or unauthenticated user triggering a file‑scan operation—such as uploading a file or calling a scan API—which causes the server to construct and send a malicious HTTP or HTTPS request to an arbitrary host. The attacker can gain the server’s outbound network reach, potentially accessing internal resources or pivoting to other systems. The attack requires the anti‑virus plugin to be enabled and the server to have outbound connectivity to the target host.