CVE-2025-53831highCWE-79

CVE-2025-53831: fallo de gravedad alta en owncloud DrawIO for ownCloud

DrawIO for ownCloud 10 is vulnerable to Stored XSS

Publicada el

Seguir esta CVE+ Monitorear ownCloud 10+ Monitorear DrawIO for ownCloud

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.2epss 0.3%
DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage improper neutralization of input during web page generation to achieve stored XSS. Upgrade ownCloud 10 to version 10.15.3 or later or upgrade DrawIO for ownCloud 10 to version 1.0.2 or later to receive a patch.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Productos afectados
owncloud · DrawIO for ownCloudowncloud · ownCloud 10
CVEs relacionadas — owncloud DrawIO for ownCloud

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-53829HIGHownCloud 10 is vulnerable to Relative Path TraversalEPSS 0.5%CVE-2025-53830CRITICALAnti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)EPSS 0.5%CVE-2025-53828HIGHSharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)EPSS 0.4%