FM / owncloud

/var/softaculous/owncloud

Name	Size	Mode	Actions
images/	-	0755	rm
php53/	-	0755	rm
php56/	-	0755	rm
php71/	-	0755	rm
php81/	-	0755	rm
php82/	-	0755	rm
.htaccess	3517	0644	edit dl rm
changelog.txt	4312	0644	edit dl rm
check_suphp.php	101	0644	edit dl rm
clone.php	5287	0644	edit dl rm
config.php	917	0644	edit dl rm
edit.php	4931	0644	edit dl rm
edit.xml	433	0644	edit dl rm
fileindex.php	269	0644	edit dl rm
import.php	3966	0644	edit dl rm
info.xml	3603	0644	edit dl rm
install.js	924	0644	edit dl rm
install.php	11512	0644	edit dl rm
install.xml	2563	0644	edit dl rm
md5	2484	0644	edit dl rm
notes.txt	1869	0644	edit dl rm
PasswordHash.php	6831	0644	edit dl rm
restore.php	2909	0644	edit dl rm
update_pass.php	6796	0644	edit dl rm
upgrade.php	5948	0644	edit dl rm
upgrade.xml	330	0644	edit dl rm
_.htaccess	315	0644	edit dl rm

Edit: /var/softaculous/owncloud/changelog.txt (4312B)

# Changelog for ownCloud Core [10.16.4] (2026-07-29)

The following sections list the changes in ownCloud core 10.16.4 relevant to
ownCloud admins and users.

[10.16.4]: https://github.com/owncloud/core/compare/v10.16.3...v10.16.4

## Summary

* Bugfix - Fix subadmin email change updating caller's address instead of target's: [#41574](https://github.com/owncloud/core/pull/41574)
* Change - Honour the write hook veto on legacy chunked WebDAV uploads: [#41763](https://github.com/owncloud/core/pull/41763)

## Details

* Bugfix - Fix subadmin email change updating caller's address instead of target's: [#41574](https://github.com/owncloud/core/pull/41574)

The verification token and confirmation link in the subadmin path of
   setMailAddress were associated with the caller's account instead of the target
   user's account. Clicking the confirmation link changed the subadmin's email
   rather than the intended target's email.

https://github.com/owncloud/core/pull/41574

* Change - Honour the write hook veto on legacy chunked WebDAV uploads: [#41763](https://github.com/owncloud/core/pull/41763)

The legacy WebDAV chunked upload path assembled the final file without
   respecting the pre-write hook result, so the filename blacklist that applies to
   ordinary uploads was not enforced for chunked uploads. The chunked assembly now
   aborts when a write hook vetoes the file, matching the non-chunked upload path.

https://github.com/owncloud/core/pull/41763

Changelog for ownCloud Core 10.16.3 (2026-05-22)

The following sections list the changes in ownCloud core 10.16.3 relevant to ownCloud admins and users.
Summary

Security - Update phpseclib to 3.0.52 for CVE-2026-40194: #41529
    Security - Restrict AppConfigController read methods to full admins only: #41550
    Security - Update symfony/routing to 5.4.52 for CVE-2026-45065: #41559
    Bugfix - Prevent mounting local storage if not allowed: #41538
    Bugfix - Use the correct user ID when changing email via admin API: #41539
    Bugfix - Prevent IDOR in WebDAV comments API: #41558

Details

Security - Update phpseclib to 3.0.52 for CVE-2026-40194: #41529

CVE-2026-40194: Timing attack vulnerability in SSH binary packet processing. Upgraded phpseclib/phpseclib from 3.0.50 to 3.0.52.

https://github.com/owncloud/core/pull/41529 https://github.com/owncloud/core/pull/41541 https://github.com/phpseclib/phpseclib/releases/tag/3.0.51

Security - Restrict AppConfigController read methods to full admins only: #41550

Subadmin users could read all oc_appconfig values including SMTP passwords, LDAP bind credentials, and encryption master keys via the Settings API. Removed @NoAdminRequired from getApps, getKeys, and getValue so that the AdminMiddleware enforces full-admin-only access, consistent with the write methods.

https://github.com/owncloud/core/pull/41550

Security - Update symfony/routing to 5.4.52 for CVE-2026-45065: #41559

CVE-2026-45065: UrlGenerator route-requirement bypass via unanchored regex alternation allowing off-site URL injection. Upgraded symfony/routing from 5.4.48 to 5.4.52.

https://github.com/owncloud/core/pull/41559 https://symfony.com/cve-2026-45065

Bugfix - Prevent mounting local storage if not allowed: #41538

Mounting a local storage was possible if the internal class name was used as backend, despite local storage not allowed to be mounted. This problem is fixed and the local storage can't be mounted if it was explicitly disallowed in the configuration.

https://github.com/owncloud/core/pull/41538

Bugfix - Use the correct user ID when changing email via admin API: #41539

The admin API endpoint for changing a user's email address was incorrectly using the requesting admin's user ID instead of the target user's ID, causing the admin's email to be updated rather than the intended user's.

https://github.com/owncloud/core/pull/41539

Bugfix - Prevent IDOR in WebDAV comments API: #41558

Authenticated users could read, edit, or delete comments on files they have no access to by supplying an arbitrary comment ID in the WebDAV comments endpoint. The fix verifies that a requested comment belongs to the file in the URL before returning it.

https://github.com/owncloud/core/pull/41558

cmd: