CVE-2020-28645

—

CVSS 3.1

9.1 critical

EPSS

1%p67

Published

Feb 9, 2021 (Feb 9, 2021)

Modified

Jun 17, 2026

Description

Deleting users with certain names caused system files to be deleted. Risk is higher for systems which allow users to register themselves and have the data directory in the web root. This affects ownCloud/core versions < 10.6.

Vendors: owncloud
Products: owncloud
Weakness: CWE-20
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.