CVE-2021-35948: ownCloud

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie.

Affected products

• ownCloud ownCloud: before 10.8.0 (fixed in 10.8.0)

Published 2021-09-07. Last modified 2026-06-17.