---
title: "ownCloud graphapi CVE-2023-49103: phpinfo Credential Leak"
url: https://erroneo.us/security/briefs/owncloud-graphapi-cve-2023-49103-phpinfo-credential-leak/
description: "ownCloud graphapi 0.2.0-0.3.0 served phpinfo to anyone, leaking admin passwords in Docker installs. Fixed in 0.3.1; delete the file and rotate secrets."
type: security-brief
section: "Security Digest"
date_published: 2023-11-21
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-49103"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# ownCloud graphapi CVE-2023-49103: phpinfo Credential Leak

**Verdict: Check exposure.** Fixed since late 2023 and mass-scanned since; confirm GetPhpInfo.php is gone everywhere, and if a vulnerable server was online, assume its environment secrets leaked and rotate them, because patching does not revoke stolen passwords.

- **Who must act:** Operators of self-hosted ownCloud Server with graphapi 0.2.0 to 0.3.0, above all Docker deployments built from February 2023 onward that pass the admin password and other secrets as environment variables.
- **Who can relax:** ownCloud Infinite Scale and ownCloud.Online users, which ownCloud says are not affected, and self-hosted servers without graphapi or already on graphapi 0.3.1 with secrets rotated.
- **Affected:** ownCloud graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1 (CVE record); Official ownCloud Server Docker images from February 2023 onward ship graphapi by default (Rapid7)
- **Fixed:** graphapi 0.3.1 (or 0.2.1), plus deleting GetPhpInfo.php; ownCloud Server 10.13.3 per ownCloud's December 2023 notice; Current releases: ownCloud Server 10.16.6 (Oct 6, 2026) and 11.0.1 (Sep 25, 2026)
- **CVEs:** CVE-2023-49103
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check every ownCloud Server for the graphapi app and its version with occ app:list.
2. Delete apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php wherever it exists and update graphapi to 0.3.1 or later.
3. Upgrade ownCloud Server to a current release (10.16.6 or 11.0.1); on Docker, pull a current image and recreate the container.
4. Add phpinfo to PHP's disable_functions list.
5. If a vulnerable server was reachable from the internet, rotate the admin password, mail, database and object-store/S3 credentials and any other secret in its environment.

### How to check if you are affected

- Search web server access logs for GetPhpInfo.php requests that returned HTTP 200 with a non-zero body; attempts against Docker installs often append a suffix such as /.css.
- After any successful hit, review ownCloud admin logins and new admin accounts from that date onward.
- Check mail, database and S3 access logs for use of the leaked credentials from unfamiliar addresses.
- Test from outside that the GetPhpInfo.php URL, with and without /.css, no longer returns 200.

## What happened

On November 21, 2023, ownCloud published an [advisory](https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/) for its graphapi app, an add-on for the classic PHP ownCloud Server. The app bundled a third-party Microsoft Graph library whose test folder contained `GetPhpInfo.php`, a script that calls PHP's `phpinfo()`. Anyone could request it without logging in. The output includes all of the web server's environment variables. In containers, the advisory says, these "may include sensitive data such as the ownCloud admin password, mail server credentials, and license key." ownCloud warns that disabling the app does not eliminate the flaw.

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-49103) lists graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1, with a CVSS 3.1 score of 10.0. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-49103) scores it 7.5, as confidentiality-only. Exploitation began within days. [The Record](https://therecord.media/experts-warn-of-owncloud-vulnerability-being-exploited) reported that GreyNoise saw attacks from November 25 from at least 12 IP addresses, and that Shadowserver counted more than 11,000 exposed ownCloud IPs. [Rapid7](https://www.rapid7.com/blog/post/2023/12/01/etr-cve-2023-49103-critical-information-disclosure-in-owncloud-graph-api/) found that early exploits failed against Docker installs, which answered with a redirect, and that appending a segment such as `/.css` got past the Apache rewrite rules. It saw attempts in at least three customer environments. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49103) on November 30, 2023.

## Who is affected

Self-hosted ownCloud Server with graphapi 0.2.0 through 0.3.0. According to Rapid7, the official Docker images include graphapi by default from February 2023 onward, while manual installs do not. Docker setups commonly pass `OWNCLOUD_ADMIN_USERNAME` and `OWNCLOUD_ADMIN_PASSWORD` as environment variables, so one request could hand over an admin login. ownCloud says containers created before February 2023 are not vulnerable to the credential leak. Its [December 1, 2023 notice](https://owncloud.com/news/immediate-action-required-critical-security-updates-for-owncloud/) says Infinite Scale and managed services, including ownCloud.Online, are not affected.

## Do you really need to act?

Most teams fixed this in 2023, so check exposure. Two points still matter. First, the leak is a one-time read. An attacker who pulled your `phpinfo` page in late 2023 may still hold working passwords if nobody rotated them, and updating the app does not revoke them. Second, a server still on graphapi 0.3.0 is probably also on an old ownCloud core. That leaves it open to CVE-2023-49105, the WebDAV pre-signed URL bypass disclosed the same day, which CISA added to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105) on August 27, 2026.

## What to do now

1. Check each server: `sudo -u www-data php occ app:list | grep -i graphapi`, or `docker exec <container> occ app:list | grep -i graphapi` on Docker.
2. Run `find / -name GetPhpInfo.php -path '*graphapi*' 2>/dev/null`, delete any hit, and update graphapi to 0.3.1 or later.
3. Upgrade ownCloud Server to a current release. The [changelog](https://owncloud.com/changelog/server/) lists 10.16.6 and 11.0.1. On Docker, pull a current image and recreate the container.
4. Add `phpinfo` to `disable_functions` in `php.ini`, as Rapid7 recommends.
5. If a vulnerable server was reachable from the internet, rotate the admin password and the mail, database and object-store/S3 credentials, as ownCloud advises, plus any other secret in the container environment.

## How to tell if you were hit

- Search access logs: `zgrep -h 'GetPhpInfo.php' /var/log/apache2/access.log* | awk '$9 == 200'`. Rapid7 says a 200 means success, a 404 or 302 means failure, and a zero-length body means `phpinfo` was disabled. Docker attempts often carry a suffix such as `/.css`.
- After any successful hit, review ownCloud admin logins and new admin accounts from that date onward.
- Check mail, database and S3 logs for use of the leaked credentials from unfamiliar addresses.
- From outside, confirm `curl -s -o /dev/null -w '%{http_code}\n' https://cloud.example.com/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.css` no longer returns 200.

## Timeline

- Nov 21, 2023 — ownCloud publishes the advisory, and the CVE is published.
- Nov 25, 2023 — GreyNoise sees exploitation begin.
- Nov 30, 2023 — CISA adds CVE-2023-49103 to KEV.
- Dec 1, 2023 — ownCloud tells customers to update graphapi to 0.3.1 and the server to 10.13.3. Rapid7 publishes the `/.css` bypass.
- Dec 21, 2023 — Federal remediation deadline.
- Aug 27, 2026 — CISA adds the sibling CVE-2023-49105 to KEV.

## Sources

1. [ownCloud — Disclosure of sensitive credentials and configuration in containerized deployments](https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/)
2. [ownCloud — Immediate action required: critical security updates for ownCloud](https://owncloud.com/news/immediate-action-required-critical-security-updates-for-owncloud/)
3. [ownCloud — Server changelog](https://owncloud.com/changelog/server/)
4. [CVE record — CVE-2023-49103](https://www.cve.org/CVERecord?id=CVE-2023-49103)
5. [NVD — CVE-2023-49103](https://nvd.nist.gov/vuln/detail/CVE-2023-49103)
6. [CISA — Known Exploited Vulnerabilities: CVE-2023-49103](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49103)
7. [CISA — Known Exploited Vulnerabilities: CVE-2023-49105](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105)
8. [Rapid7 — ETR: CVE-2023-49103: Critical Information Disclosure in ownCloud Graph API](https://www.rapid7.com/blog/post/2023/12/01/etr-cve-2023-49103-critical-information-disclosure-in-owncloud-graph-api/)
9. [The Record — Experts warn of critical ownCloud vulnerability being exploited](https://therecord.media/experts-warn-of-owncloud-vulnerability-being-exploited)
10. [BleepingComputer — Hackers start exploiting critical ownCloud flaw, patch now](https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-owncloud-flaw-patch-now/)

---
Source page: https://erroneo.us/security/briefs/owncloud-graphapi-cve-2023-49103-phpinfo-credential-leak/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt