en
German
Contact
ownCloud on GitHub
Blog
Search
Close

Infinite Scale | opensource | OSPO | ownCloud | Release | security | Updates

A Critical Vulnerability in libvips: What ownCloud Users and Operators Need to Know

The Kiteworks OSPO and the ownCloud and Kiteworks security research teams have identified a critical vulnerability in libvips. If you run ownCloud Infinite Scale (oCIS), or any infrastructure that processes images, please take note. The latest version of ownCloud Infinite scale has already addressed this issue on the application level.

A Critical Vulnerability in libvips: What ownCloud Users and Operators Need to Know

If you run ownCloud Infinite Scale (oCIS), or any infrastructure that processes images, there’s something you need to check today.
The Kiteworks OSPO and the ownCloud and Kiteworks security research teams have identified a critical vulnerability in libvips, a widely used open source image processing library. We’re publishing this now as part of our commitment to transparency with the ownCloud community, and because we think you deserve to know promptly rather than waiting for the broader disclosure cycle to play out.

What is libvips, and why does it matter here?

libvips is a fast, low-memory image processing library that shows up as a dependency in a surprisingly wide range of software.
You might not have installed it directly. It often arrives as a transitive dependency, something another package pulled in without it being obvious.
If you run oCIS upgrade to oCIS 8.0.4, or other tools that handle image processing, there’s a real chance libvips is somewhere in your stack.
The vulnerability carries an anticipated CVSS v3.1 score of 10.0. It hasn’t yet been assigned a CVE identifier, but a fix exists in libvips version 8.18.2 upstream.

The container problem

This is where it gets complicated for a lot of operators. Even if you’ve applied application-level fixes, your underlying container base image may still be running a vulnerable version of libvips. Alpine Linux, for instance, which is the base image for a huge proportion of containerized workloads in the cloud-native world, doesn’t yet (as of today, 26/06/01) carry a patched package version. That means patching at the OS package level isn’t currently an option if you’re on Alpine. Your environment may still be exposed even if everything at the application layer looks clean.

Please audit your infrastructure. Specifically, check the base images of any container workloads that might be pulling in libvips, directly or indirectly.

oCIS is already patched

The good news is that ownCloud Infinite Scale has already addressed this at the application level by using the community image of Alpine to build the latest version 8.0.4.
If you’re running oCIS, update to a version that includes this fix. If you’re not sure whether your deployment is current, this is a good moment to check.
OpenCloud is a fork of ownCloud of ownCloud Infinite Scale, and because we share a significant portion of the same codebase, vulnerabilities that affect oCIS are often relevant to them as well. We reached out privately before publishing this post. That’s just how responsible disclosure works between projects with shared ancestry, especially within open source, and we sometimes overlook the respect and dedication this shows, as both our communities have done this for each other in the past.

What should you actually do right now?

If you’re an operator or sysadmin: update oCIS if you haven’t already, and audit your container base images for libvips. Don’t assume that an application-layer fix is enough if you’re running Alpine-based containers.

If you’re a developer: check whether libvips appears anywhere in your dependency tree, including indirectly. The vips binary or the libvips package in your container image are the things to look for.

If you’re a less technical user or manager: the short version is that ownCloud Infinite Scale has been patched, and your team should verify that your deployment is running the updated version. If you use a managed ownCloud hosting service, check in with your provider.

If you have questions or think you’ve found something related in your own environment, please reach out to the ownCloud security team.

Go to news overview

ownCloud

June 1, 2026

Read now:

ownCloud Web and oCIS Are Now One Codebase. All Apache-2.0.

ownCloud Web and oCIS Are Now One Codebase. All Apache-2.0.

Jul 14, 2026

Two codebases just became one. The ownCloud Web frontend now lives inside owncloud/ocis under web/, all under Apache-2.0. One repository, one licence, one CI pipeline, one contribution surface. Years of contribution history preserved, everything moved into a single home. This is what the OSPO relicensing programme looks like when it reaches the core product.

read more
Alt Text for Every Image. No Manual Work. No Excuses.

Alt Text for Every Image. No Manual Work. No Excuses.

Jul 13, 2026

Missing alt text is one of the most commonly flagged WCAG failures. EN 301 549 mandates it for public sector ICT across Europe. As of today, oCIS ships an extension that generates a credible first draft with your configured vision LLM, lets the user edit it, and writes it back to the file as a WebDAV property that survives the session. A meaningful compliance tool, not just a convenience feature.

read more
ownCloud Server 11.0.0-rc1: First Release Candidate for the Next Major Version

ownCloud Server 11.0.0-rc1: First Release Candidate for the Next Major Version

Jul 8, 2026

The first release candidate for ownCloud Server 11 is out. This is the release that surfaces breakage: PHP 7 support dropped, deprecated database and group-management classes removed, major version bumps to Doctrine DBAL and Symfony, subadmin disabled by default. Three security fixes underneath.
Do not deploy in production. Do test against your apps and integrations.

read more