05.02.2026 - Updates
Our security team at OpenCloud has discovered a vulnerability in Public Links and rated it CVSS 8.2 (High). This vulnerability was originally created in the code of ownCloud (Kiteworks) and was also included in the OCIS fork of OpenCloud.
As is customary in the open source environment, the team informed both CERN and ownCloud (Kiteworks) in advance, whose software is based in part on the same codebase as OpenCloud. This ensured that all affected parties were able to check their codebase and protect customer installations, such as the BayernCloud Schule (ByCS).
Today we are publicising this vulnerability and providing an important patch for OpenCloud.
We handled the discovery in accordance with responsible disclosure principles. Our customers with an Enterprise licence were protected at all times via their subscription. We ensure that every customer is informed and receives the necessary support for rapid protection and updates. Our support team is still available to answer any questions our customers may have.
All OpenCloud instances below version 4.0.3 and all instances below 5.0.2 are affected. The patched versions are 4.0.3 and 5.0.2.
With the release of the vulnerability today, we are also publishing the patch publicly online. We recommend that you schedule and install the update very immediately to ensure the security of your data.
→ You can find the current patch version in the advisory
For more information, please also take a look at our release notes and read our blog "Vulnerabilities in the code: Why transparency and enterprise licences provide security"
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。