PHP Vulnerability Responses by Company

ownCloud GmbH

Global cloud / infrastructure
Aliases / services
オウンクラウド / ownCloud Classic / Kiteworks ownCloud / ownCloud / ownCloud GmbH
Official website
https://owncloud.com/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

ownCloud Classic (official Docker images)

Response status
Fixed images available; re-pull required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provides file sharing software.

Official 11.0.1 and 10.16.6 images include PHP fixes; an earlier same-day 10.16.6 build did not.

Scope: Check PHP 7.4 revision -31 for ownCloud 10, or Ubuntu 8.3.6 .13 for 11; tags and php -v alone are insufficient.

What users should do

Re-pull, recreate containers, and verify the PHP package revision.

Official service URL

Source URLs

  1. https://github.com/orgs/owncloud/discussions/27https://github.com/orgs/owncloud/discussions/27Response evidence
  2. https://central.owncloud.org/t/critical-update-for-owncloud-classic-available-php-vulnerabilities/95106https://central.owncloud.org/t/critical-update-for-owncloud-classic-available-php-vulnerabilities/95106Service and operation documentation

ownCloud Classic (non-Docker)

Response status
Operator PHP update required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Official guidance requires non-Docker Classic operators to patch PHP.

Scope: Official Docker-image fixes do not patch this deployment.

What users should do

Apply the PHP vendor's fixes.

Source URLs

  1. https://central.owncloud.org/t/critical-update-for-owncloud-classic-available-php-vulnerabilities/95106https://central.owncloud.org/t/critical-update-for-owncloud-classic-available-php-vulnerabilities/95106Response evidence

ownCloud Infinite Scale (oCIS)

Response status
Not affected (official statement)
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The notice excludes oCIS because it does not use PHP.

Scope: This exclusion does not cover Classic.

What users should do

No action for this incident.

Source URLs

  1. https://central.owncloud.org/t/critical-update-for-owncloud-classic-available-php-vulnerabilities/95106https://central.owncloud.org/t/critical-update-for-owncloud-classic-available-php-vulnerabilities/95106Response evidence
Related official sources
  1. ownCloud Classic 11 system requirementsOfficial information directory

Comments