PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5876 Owncloud CVE debrief

CVE-2016-5876 affects ownCloud server installations when the gallery app is enabled. The issue allows a remote attacker to download arbitrary images through a direct request. NVD rates the weakness as Medium severity (CVSS 5.9) with network attack vector, no privileges required, and no user interaction.

Vendor
Owncloud
Product
CVE-2016-5876
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Administrators and security teams running ownCloud server deployments, especially instances with the gallery app enabled and any environment still on affected pre-8.2.6 or pre-9.0.3 releases.

Technical summary

According to the CVE description, ownCloud server versions before 8.2.6 and 9.x before 9.0.3 are affected when the gallery app is enabled. The attacker can trigger direct requests to download arbitrary images. NVD maps the issue to CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N and CWE-264.

Defensive priority

Medium. The issue is network-reachable and can expose image confidentiality, but the published CVSS indicates high attack complexity and no integrity or availability impact.

Recommended defensive actions

  • Upgrade ownCloud server to a fixed release at or above 8.2.6 or 9.0.3.
  • Review whether the gallery app is enabled anywhere in production and disable it where it is not needed.
  • Confirm affected instances against the NVD version criteria and the vendor advisory before scheduling remediation.
  • After upgrading, verify that direct image download requests are no longer accepted for unauthorized access patterns.

Evidence notes

The CVE description states: ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via a direct request. NVD reference data includes the ownCloud vendor advisory and a SecurityFocus BID entry. NVD CPE criteria enumerate affected ownCloud versions up to 8.2.5 and specific 9.0.0, 9.0.1, and 9.0.2 releases.

Official resources

CVE published on 2017-01-23. This summary uses the CVE publication date and the source metadata provided; NVD later modified the record on 2026-05-13.