CVE-2023-49105 is a 9.8 severity authentication bypass in the ownCloud WebDAV API. It lets an attacker access, modify or delete any file without authenticating, provided they know the victim's username and the victim has no signing key configured.

No signing key is the default configuration.

ownCloud disclosed it in November 2023. Versions 10.6.0 through 10.13.0 are affected; 10.13.1 fixes it. That patch has been available for nearly three years.

What it was used to take

A nuclear research body in the Philippines was compromised, along with a marine engineering and shipbuilding company that provides services to the Philippine Navy.

From the nuclear entity, the intruders took nuclear-material account records, draft strategic plans covering 2023 to 2028, material on research reactor core components, historical fuel inventories, presentation material and employee personal information.

They also took a 192 MB SQL dump of a ZKTeco BioTime attendance and personnel database, and credential stores — BitLocker keys, a KeePass database, and AxCrypt-encrypted files.

In total, an estimated 176 files, roughly 372 MB, staged across five directories.

Nuclear-material accounting records and fuel inventories are the documents by which a state demonstrates that fissile material is where it is supposed to be. Whatever the motive, that is a materially different category of theft from a customer database.

Why a three-year-old flaw still works

Because patching an internally-facing file server is nobody's priority, and because the exploitable condition is the default.

The vulnerability needs a known username, and usernames at a research institution are usually predictable from published staff lists. It needs no signing key configured, which is what you get if you never changed anything. And ownCloud instances tend to be departmental rather than central — stood up by a team, never inventoried, never in the patch cycle.

Hunt.io found five custom Python scripts implementing exploits for this CVE on an open directory at a single IP address. Five purpose-built tools for a 2023 flaw is not opportunistic scanning; it is somebody maintaining a capability because it keeps working.

CISA added the CVE to its Known Exploited Vulnerabilities catalog on 27 August 2026, with a federal deadline of 30 August. It is the second entry this week where the listing arrived long after the exploitation.

On the attribution, carefully

The reporting attributes this to a Chinese-speaking threat actor, identified in part through simplified Chinese in source code comments, docstrings, log output, and the folder names used to sort stolen data.

That evidence supports a specific claim: whoever wrote the tooling writes in simplified Chinese. It does not by itself establish nationality, employer, or state direction, and it is the sort of artefact that is trivially planted by anyone who wants an investigation to reach that conclusion.

We wrote the same caution about the UK power plant attack, where the CEO of Dragos warned publicly that people jumping to conclusions on attribution are susceptible to false flag operations. It applies identically here. Language in comments is a lead, not a finding.

The targeting — nuclear research and naval shipbuilding in one country — is more informative than the language, because it indicates an interest rather than an author.

What to do

  • Find your ownCloud instances. The ones that matter are the ones nobody remembers standing up.
  • Upgrade to 10.13.1 or later. The fix is nearly three years old.
  • Configure a signing key. The exploit condition is the default state.
  • Do not expose file servers to the internet without a compelling reason and a maintenance owner.
  • Treat credential stores on file shares as already lost if you find evidence of access. BitLocker keys and password databases were among what was taken here.

What is not established

  • How initial access to the ownCloud instances was obtained.
  • How valid usernames were obtained, which the exploit requires.
  • Who directed the operation. Language artefacts are not attribution.
  • What has been done with the material since.
  • Whether other institutions were hit by the same tooling.