A patch that has existed for over two years does not stop a vulnerability from being dangerous. It only stops it from being an excuse.
A pre-signed URL flaw with a 9.8 severity score
CVE-2023-49105 is a WebDAV API authentication bypass in ownCloud’s core package, affecting versions 10.6.0 through 10.13.0 and carrying a CVSS score of 9.8. The flaw lets an attacker access, modify or delete any file without authentication, as long as they know the target username and that user has no signing key configured, which happens to be the default setup. ownCloud fixed the issue in version 10.13.1, released in late 2023, which means the fix has been available for roughly three years.
Why CISA acted on it now
CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 27, 2026, after custom Python exploit scripts turned up in the aftermath of a real attack: adversaries used CVE-2023-49105 to exfiltrate 176 files from a nuclear research body in the Philippines. That confirmed real-world exploitation, not just theoretical risk, and it triggered a Federal Civilian Executive Branch remediation deadline of August 30, 2026. Two other actively exploited flaws, in the Linux kernel and JFrog Artifactory, were added to the catalog in the same batch.
Why this matters specifically for European organisations
ownCloud is a German-built platform, and a large part of its adoption across Europe comes from organisations choosing it precisely so that their file storage and sync infrastructure stays under their own control and within EU jurisdiction, rather than sitting inside a US-owned SaaS product. That is a legitimate and often well-reasoned decision. But self-hosting shifts the patching responsibility entirely onto the organisation running it, and an internet-facing instance still on core 10.13.0 or earlier, three years after the fix shipped, is not a hypothetical, it is now a confirmed active attack pattern with public exploit tooling behind it.
What to check today
If your organisation runs ownCloud, or manages it for clients, the immediate task is straightforward: confirm the core version is at least 10.13.1, and separately confirm that signing keys are actually configured for accounts that use pre-signed WebDAV URLs, since that is the specific condition this bypass depends on. A version check alone is not enough if the underlying configuration gap that made the bug exploitable in the first place was never closed.
If you need a rapid audit of your self-hosted file infrastructure, or want a second opinion on whether your organisation’s data sovereignty setup is actually being maintained the way it needs to be, contact Excello Digital. We help European teams keep the infrastructure they chose for control from becoming the reason they lose it.