This is where it gets complicated for a lot of operators. Even if you’ve applied application-level fixes, your underlying container base image may still be running a vulnerable version of libvips. Alpine Linux, for instance, which is the base image for a huge proportion of containerized workloads in the cloud-native world, doesn’t yet (as of today, 26/05/28) carry a patched package version. That means patching at the OS package level isn’t currently an option if you’re on Alpine. Your environment may still be exposed even if everything at the application layer looks clean.

Please audit your infrastructure. Specifically, check the base images of any container workloads that might be pulling in libvips, directly or indirectly.

The good news is that ownCloud Infinite Scale has already addressed this at the application level by using the community image of Alpine to build the latest version 8.0.4.

If you’re running oCIS, update to a version that includes this fix. If you’re not sure whether your deployment is current, this is a good moment to check.

OpenCloud is a fork of ownCloud of ownCloud Infinite Scale, and because we share a significant portion of the same codebase, vulnerabilities that affect oCIS are often relevant to them as well. We reached out privately before publishing this post. That’s just how responsible disclosure works between projects with shared ancestry, especially within open source, and we sometimes overlook the respect and dedication this shows, as both our communities have done this for each other in the past.

If you’re an operator or sysadmin: update oCIS if you haven’t already, and audit your container base images for libvips. Don’t assume that an application-layer fix is enough if you’re running Alpine-based containers.

If you’re a developer: check whether libvips appears anywhere in your dependency tree, including indirectly. The vips binary or the libvips package in your container image are the things to look for.

If you’re a less technical user or manager: the short version is that ownCloud Infinite Scale has been patched, and your team should verify that your deployment is running the updated version. If you use a managed ownCloud hosting service, check in with your provider.

We’ll share more details, including the CVE once it’s assigned, as the disclosure process moves forward.
In the meantime, if you have questions or think you’ve found something related in your own environment, please reach out to the ownCloud security team.