CVE-2015-5954 - CVE House
Back to Database
Status published Medium CVE-2015-5954

The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before...

Vulnerability Description

The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a file with a deleted parent folder.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-5954

Credits & Attribution

No credits recorded in the NVD database.

References

More from owncloud

View All →
CVE-2025-53831
DrawIO for ownCloud 10 is vulnerable to Stored XSS
High 8.2
CVE-2025-53830
Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)
Critical 9.1
CVE-2025-53829
ownCloud 10 is vulnerable to Relative Path Traversal
High 8
CVE-2025-53828
SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)
High 8.5
CVE-2025-53827
ownCloud Core: Updater has an exposed dangerous method or function
Critical 9.1

Affected Vendor

Affected Software

owncloud, owncloud server
Vulnerable Versions:
0, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 8.0.0, 8.0.2, 8.0.3, 8.0.4

Timeline

Official Publish: October 21st, 2015
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.