Release overview

ownCloud Server 11.0.0 was tagged in the owncloud/core repository on July 30, 2026, the first stable release of the 11.x line (referred to here as oC11). Release page: https://github.com/owncloud/core/releases/tag/v11.0.0. Release availability and date are confirmed via that GitHub Release page; the change content in this post is drawn from CHANGELOG.md as it existed at the v11.0.0 tag, since core’s GitHub Release body is a short mirror notice rather than a full changelog.

Three release candidates preceded this stable tag: v11.0.0-rc1 (June 29), rc2 (July 23), and rc3 (July 29). The CHANGELOG.md at v11.0.0 lists 47 entries in total: 11 security fixes, 19 bugfixes, and 17 other changes. PHP 8.3 is now the minimum supported PHP version, the headline distinction from the still-maintained PHP 7.4 / oC10 branch (currently at 10.16.4).

Getting eleven security fixes, nineteen bugfixes, and a major PHP baseline bump through three release candidates in about a month reflects a lot of coordinated work across the project. Thank you to everyone who reported, reviewed, and tested these changes.

Security fixes

Eleven security issues are addressed in this release. Entries from CHANGELOG.md include:

• occ command injection guard: „Prevent params body from overriding validated occ command“ closes a path where an attacker in possession of an updater secret could execute unauthorized server commands, since the params array could overwrite the URL-validated command via array_merge. (PR #41577)
• Federation token exposure: „Remove plaintext federation auth token from error log“ stops a federation auth token from being written in plaintext to error logs reachable through public endpoints, closing two separate log sites that recorded the token verbatim. (PR #41578)
• Token comparison timing: „Replace strcmp token oracle with hash-based comparison“ replaces a comparison that let an unauthenticated attacker recover a stored federation token via binary search in roughly 96 requests, swapping in a constant-time hash comparison. (PR #41579)
• Public share preview access control: „Enforce the read permission in the public share preview endpoint“ closes a gap where the preview endpoint did not check the read permission before serving a shared file’s preview. (PR #41751)
• User enumeration: „Prevent user enumeration via differential password reset UI“ removes a difference in the password-reset UI’s response that could be used to determine whether a given username exists on LDAP-backed instances. (PR #41586)
• Sub-admin restriction: the group-admin feature is now disabled by default, gated behind the allow_subadmins configuration flag, reducing the default privilege surface for new installs. (PR #41634)
• Path confinement for LDAP home directories: „Confine backend provided user homes to the data directory“ closes a path where an LDAP-supplied homeDirectory attribute, previously accepted after only a leading-slash check, could point at the ownCloud code directory itself; writing into that location could lead to remote code execution. Backend-provided homes are now rejected unless they resolve inside the configured data directory (or an explicitly allow-listed base directory). (PR #41752, with a related fix in owncloud/user_ldap#849)
• Error-message information disclosure: storage connection error messages are sanitized so they no longer disclose resolved IP addresses and port numbers to authenticated clients; the full error is now logged server-side only. (PR #41585)
• DAV property XSS: search-highlight text is now HTML-encoded before being returned as a WebDAV property, closing an XSS vector via file content matched in search. (PR #41760)
• Deserialization hardening: unserialize() use inside CommandJob is restricted to verified command implementations, closing a potential remote-code-execution path that depended on an attacker with database write access injecting crafted serialized data into the oc_jobs table. (PR #41582)
• Cached binary path validation: paths to the preview helper binaries (ffmpeg, avconv, AtomicParsley) are now validated and quoted before use rather than trusted from cache and interpolated unquoted into shell commands. (PR #41732)

The CHANGELOG.md entries at this tag do not include CVE identifiers for these fixes; this post lists the fix descriptions as written in the changelog rather than assigning CVE numbers.

PHP 8.3 and the oC10 / oC11 split

ownCloud Server 11.0.0 requires PHP 8.3 or newer. This release formally splits the ownCloud Classic server line: PHP 7.4-based installs continue on the 10.16.x branch (oC10, most recently 10.16.4), while PHP 8.3-based installs move to 11.x (oC11). Administrators on PHP 7.4 cannot install 11.0.0 directly; upgrading the PHP runtime to 8.3 is a prerequisite, not a side effect of the ownCloud application upgrade.

Code signing: G1 sunset, G2 arrives

11.0.0 introduces a new per-app PKI for code signing, using ECDSA-P384/SHA-384 (G2), replacing the previous G1 scheme. G2 verification enforces full certificate-chain validation against bundled trust anchors, an algorithm allow-list, and a fail-closed CRL check, rather than checking a single leaf certificate. G1 signatures are scheduled to sunset on January 1, 2027 (the hardcoded cutoff is 2026-12-31T23:59:59Z). Marketplace apps and external-storage backends need a G2-signed build available before that date: files_external_dropbox 2.1.1 and files_external_ftp 0.3.1 each shipped a re-sign-only release on July 22, about a week ahead of 11.0.0, to get ahead of that cutoff.

Removed and changed commands

Three occ commands are removed in this release: db:convert-type, integrity:sign-app, and integrity:sign-core. Administrators or CI pipelines that invoke these commands as part of an upgrade or packaging process need to remove or replace those steps before upgrading to 11.0.0. Integrity verification itself is unaffected: integrity:check-app and integrity:check-core continue to work as before.

Dependency updates

The CHANGELOG.md lists updates across Doctrine, Symfony, Guzzle, sabre/dav, and other security-relevant PHP dependencies, consistent with the PHP 8.3 baseline bump.

Notable bugfixes

Beyond the security list, the 19 bugfix entries include: legacy AJAX routes that were being shadowed by real files on disk are now routed correctly; a crash on malformed translation strings under PHP 8 is fixed; the avatar cropper is fixed following a Jcrop 2.0 file rename upstream; and federation support for installations running in a subdirectory (rather than webroot) is corrected.

Upgrade notes

Documented supported upgrade paths are from 8.2.11, 9.0.9, and 9.1 or later. There is no supported direct upgrade path from versions older than those. Given the PHP 8.3 requirement, upgrading the PHP runtime is a precondition administrators need to plan separately from the ownCloud application upgrade itself. Any automation referencing db:convert-type, integrity:sign-app, or integrity:sign-core needs to be updated before the upgrade.

Source

Change content in this post is drawn from CHANGELOG.md at tag v11.0.0: https://raw.githubusercontent.com/owncloud/core/v11.0.0/CHANGELOG.md. Release availability and date are confirmed via the GitHub Release page: https://github.com/owncloud/core/releases/tag/v11.0.0. The stable tag and all three release candidates were released and signed by Thomas Müller (DeepDiver1975).

ownCloud. Open Source. Original. Yours.