A high-severity relative path traversal vulnerability in ownCloud 10 could allow an authenticated administrator to access or manipulate files outside the intended storage directory.

This is a relative path traversal vulnerability (CWE-23). It requires an authenticated attacker with administrative privileges to exploit the flaw, potentially resulting in full system impact via unauthorized file access.

With a CVSS score of 8.0, this vulnerability presents a major risk to data integrity and confidentiality. By manipulating paths, an attacker could read or overwrite sensitive configuration files or data, leading to a complete compromise of the ownCloud instance and the stored assets.

Immediate Action: Update ownCloud 10 to version 10.15.3 or later to remediate the path traversal vulnerability.

Proactive Monitoring: Monitor server access logs for anomalous directory traversal patterns or unauthorized attempts to access system-level files from administrative accounts.

Compensating Controls: Restrict administrative access to trusted personnel and employ host-based intrusion detection systems to monitor for unauthorized file system modifications.

Public Exploit Available: false

Given the administrative nature of this vulnerability, immediate patching is required to prevent escalation of privilege and data loss. Ensure that administrative interfaces are not exposed to the public internet and that all instances are updated to the secure version.