CVE-2014-2044

no score yetEPSS 12%

Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream (ADS) syntax in the filename parameter, as demonstrated using .htaccess::$DATA to upload a PHP program.

EPSS: 12% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2014-10-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

owncloud:owncloud
owncloud:owncloud_server

References

http://packetstormsecurity.com/files/125585/ownCloud-4.0.x-4.5.x-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2014/Mar/45
http://secunia.com/advisories/57267
http://www.exploit-db.com/exploits/32162
http://www.osvdb.org/104082

Check your stack JSON