Hello ownCloud Community,
We are aware of the recently disclosed PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 known as PHP2Shell.
These vulnerabilities do affect OwnCloud Classic. We have updated packaging from PHP.
Please update your ownCloud Classic installations immediately to the latest versions.
Docker Image page:
ownCloud Classic versions 11.0.1 and 10.16.6 have been updated and hold the patched php runtime
Docker instructions:
-
Version 10:
- docker pull owncloud/server:10.16.6
-
Version 11:
- docker pull owncloud/server:11.0.1
Upgrade instructions:
How to Upgrade Your ownCloud Classic
Note: Customers not running docker version of OwnCloud Classic should update the PHP themselves
IF YOU ARE RUNNING OWNCLOUD INFINITE SCALE (oCIS):
This does not affect you. These CVEs are specific to ownCloud Classic use of PHP which oCIS does not use. No action is needed.
There are also security updates for users on ownCloud Classic that are using the Calendar app Calendar: ownCloud Marketplace - v2.1.1 and v2.0.1
These are Security updates - Please update immediately