---
title: "ownCloud CVE-2023-49105: 2023 WebDAV Bypass Now in KEV"
url: https://erroneo.us/security/briefs/owncloud-cve-2023-49105-webdav-presigned-url-bypass-kev/
description: "Pre-signed URL bypass in ownCloud core 10.6.0-10.13.0 lets attackers read any user's files; used to steal nuclear records. Fixed since 2023. Find old servers."
type: security-brief
section: "Security Digest"
date_published: 2026-08-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-49105"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# ownCloud CVE-2023-49105: 2023 WebDAV Bypass Now in KEV

**Verdict: Check exposure.** Up-to-date ownCloud servers are fine; any ownCloud core 10.6.0 to 10.13.0 still online should be upgraded today and treated as breached, because attackers are using this bug to empty file shares.

- **Who must act:** Anyone running self-hosted ownCloud Server (core) 10.6.0 through 10.13.x, especially internet-facing instances at research bodies, universities and agencies that rarely update.
- **Who can relax:** ownCloud Infinite Scale and ownCloud.Online users, which ownCloud says are not affected, and ownCloud Server installs already on a current 10.16.x or 11.0.x release.
- **Affected:** ownCloud core 10.6.0 through 10.13.0 (vendor advisory and CVE record); ownCloud Server below 10.13.3 (ownCloud's December 2023 upgrade guidance)
- **Fixed:** ownCloud core 10.13.1 (per the CVE record); ownCloud Server 10.13.3 or a support patch (ownCloud's December 2023 guidance); Current releases: ownCloud Server 10.16.6 (Oct 6, 2026) and 11.0.1 (Sep 25, 2026)
- **CVEs:** CVE-2023-49105
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every ownCloud Server instance and record its version (occ status, or /status.php over HTTPS).
2. Upgrade anything below 10.13.3 to a current release (10.16.6 or 11.0.1), or at minimum 10.13.3.
3. If a vulnerable instance was internet-facing, assume files were read: review WebDAV logs and tell data owners.
4. Rotate secrets stored in ownCloud, such as password vaults, key files, BitLocker recovery keys and exported credentials.
5. Confirm the graphapi app is v0.3.1 or later and GetPhpInfo.php is gone (CVE-2023-49103, also in KEV).
6. Take unmaintained instances off the internet or put them behind a VPN.

### How to check if you are affected

- Search web server logs for requests to /remote.php/dav/files/ carrying OC-Credential, OC-Verb and OC-Signature query parameters, especially with an empty OC-Date or OC-Expires=1000.
- Look for PROPFIND requests and bulk GETs from one source walking several users' directories, often a few seconds apart.
- Check logs for 31.58.209.241, the open-directory server where Hunt.io found the exploit scripts (requests may have come from elsewhere).
- Compare the data volume served to unfamiliar IPs against normal sync traffic for each account.

## What happened

In November 2023, ownCloud disclosed that its WebDAV API would accept pre-signed URLs for users who had no signing key configured. That is the default state. According to the [vendor advisory](https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/), "it is possible to access, modify or delete any file without authentication" if the attacker knows the victim's username. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-49105) lists ownCloud core 10.6.0 before 10.13.1. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-49105) scores it 9.8. It shipped alongside CVE-2023-49103, the graphapi `phpinfo` leak that CISA put in KEV in late 2023.

The pre-signed URL bug stayed off KEV until August 2026. On August 13, Hunt.io found an open directory on 31.58.209[.]241 holding five custom Python scripts aimed at the ownCloud server of a Philippine nuclear research body. Its [report](https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor) explains the trick: with no key set, "the signing routine still executed using an empty secret." The scripts forge PBKDF2-HMAC-SHA512 signatures and pull files from `/remote.php/dav/files/<account>/`. The directory held 176 stolen ownCloud files (about 372 MB). A CSV in it references roughly 9 GB taken from the agency. [The Hacker News](https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets.html) lists the recovered material, including nuclear-material account records, reactor component documents, staff data, BitLocker keys and a KeePass database. Hunt.io attributes the operation to a Chinese speaker based on language artifacts, and says the operator could be state-affiliated, contracted or independent. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105) on August 27, 2026, with an August 30 federal deadline.

## Who is affected

Self-hosted ownCloud Server (the PHP "core" product) from 10.6.0 through 10.13.0. In its [December 2023 notice](https://owncloud.com/news/immediate-action-required-critical-security-updates-for-owncloud/), ownCloud told customers the bypass "requires an upgrade to 10.13.3 or a specific patch" from support. It said ownCloud Infinite Scale and its managed services, including ownCloud.Online, are not affected. The flaw affects users without a signing key, and that is the default, so in practice every account on a vulnerable server is exposed. The attacker only needs usernames, which are often email addresses or first.last names.

## Do you really need to act?

Most organizations do not. The fix is almost three years old, and ownCloud Server has shipped many releases since. The current ones on the [changelog](https://owncloud.com/changelog/server/) are 10.16.6 and 11.0.1. If your instances are current, nothing changes.

The risk is the forgotten server: a lab, department or small agency that installed ownCloud years ago and never updated it. That is exactly the victim in Hunt.io's report. If you find one still on 10.6.0 to 10.13.0 and reachable from the internet, upgrading is not enough. The bug allows silent bulk download, so treat the data as already taken and rotate whatever secrets lived in it. KEV listing also means US federal agencies must remediate, so expect auditors to ask.

## What to do now

1. Inventory instances. On each server, run `sudo -u www-data php occ status`, or fetch `https://cloud.example.com/status.php` and read the version it reports.
2. Upgrade anything below 10.13.3 to a current release (10.16.6 or 11.0.1). If you are stuck, go at least to 10.13.3 or ask ownCloud support for the patch.
3. While you are there, update the graphapi app to v0.3.1 or later and delete `GetPhpInfo.php`, as ownCloud's 2023 notice instructs.
4. For any instance exposed while vulnerable, rotate the secrets stored in it: password databases, key files, recovery keys, service credentials and app passwords.
5. Put instances that nobody maintains behind a VPN or SSO proxy, or shut them down.

## How to tell if you were hit

Hunt.io's scripts append `OC-Credential` (the target username), `OC-Verb`, `OC-Expires=1000`, an empty `OC-Date` and `OC-Signature` to WebDAV URLs. Grep access logs for those parameters on `/remote.php/dav/files/`. The scripts also enumerate folders with `PROPFIND` and sleep a few seconds between downloads, so look for slow, steady bulk GETs from one address across several accounts. Check for `31.58.209.241`, but expect other sources too. If you find matches, scope which accounts and files were served, notify the data owners, and assume any credentials in those files are burned.

## Timeline

- Nov 21, 2023 — ownCloud publishes the advisory, and the CVE is published.
- Dec 1, 2023 — ownCloud tells customers to upgrade to 10.13.3 or apply a support patch.
- Aug 13, 2026 — Hunt.io finds the attacker's open directory. It later shares the findings with CERT-PH under TLP:AMBER.
- Aug 26, 2026 — Hunt.io publishes its report.
- Aug 27, 2026 — CISA adds CVE-2023-49105 to KEV.
- Aug 30, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [ownCloud — WebDAV Api Authentication Bypass using Pre-Signed URLs](https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/)
2. [ownCloud — Immediate action required: critical security updates for ownCloud](https://owncloud.com/news/immediate-action-required-critical-security-updates-for-owncloud/)
3. [ownCloud — Server changelog](https://owncloud.com/changelog/server/)
4. [CVE record — CVE-2023-49105](https://www.cve.org/CVERecord?id=CVE-2023-49105)
5. [NVD — CVE-2023-49105](https://nvd.nist.gov/vuln/detail/CVE-2023-49105)
6. [CISA — Known Exploited Vulnerabilities: CVE-2023-49105](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105)
7. [Hunt.io — Chinese-speaking operator targets Philippine nuclear agency and naval contractor](https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor)
8. [The Hacker News — ownCloud flaw exploited to steal nuclear records from Philippine research body](https://thehackernews.com/2026/08/snowflake-github-actions-flaw-lets.html)

---
Source page: https://erroneo.us/security/briefs/owncloud-cve-2023-49105-webdav-presigned-url-bypass-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt