CVE-2023-24804

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. The bypasses may lead to information disclosure when uploading the app’s internal files, and to arbitrary file write when uploading plain text files (although limited by the .txt extension). Version 3.0 fixes the reported bypasses.

• CWE-22
• CWE-22

• https://hackerone.com/reports/377107Exploit, Third Party Advisory
• https://owncloud.com/security-advisories/oc-sa-2023-001/Vendor Advisory
• https://securitylab.github.com/advisories/GHSL-2022-059_GHSL-2022-060_Owncloud_Android_app/Exploit, Third Party Advisory
• https://hackerone.com/reports/377107Exploit, Third Party Advisory
• https://owncloud.com/security-advisories/oc-sa-2023-001/Vendor Advisory
• https://securitylab.github.com/advisories/GHSL-2022-059_GHSL-2022-060_Owncloud_Android_app/Exploit, Third Party Advisory

Published

Feb 13, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24796Password vulnerability found in Vinga WR-AC1200 81.102.1.437…9.8
• CVE-2023-24797D-Link DIR882 DIR882A1_FW110B02 was discovered to contain a …9.8
• CVE-2023-24798D-Link DIR878 DIR_878_FW120B05 was discovered to contain a s…9.8
• CVE-2023-24799D-Link DIR878 DIR_878_FW120B05 was discovered to contain a s…9.8
• CVE-2023-2480Missing access permissions checks in M-Files Client before 2…7.8
• CVE-2023-24800D-Link DIR878 DIR_878_FW120B05 was discovered to contain a s…9.8
• CVE-2023-24805cups-filters contains backends, filters, and other software …8.8
• CVE-2023-24806Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2023-24807Undici is an HTTP/1.1 client for Node.js. Prior to version 5…7.5
• CVE-2023-24808 PDFio is a C library for reading and writing PDF files. In …6.5
• CVE-2023-24809NetHack is a single player dungeon exploration game. Startin…5.5
• CVE-2023-2481 Compiler removal of buffer clearing in sli_se_opaque_im…7.5