Skip to content
ownCloud.onlineMarketplace
DEEN
Downloads

Download owncloud.online

Cloud Storage made to trust

Get the owncloud.online server and desktop client here, with release notes and checksums. The files are hosted on GitHub.

Current version and download

Current version11.0.25Download (.tar.gz, 57.2 MB)ZIP for web hosting (64.5 MB)
Published
Oct 28, 2026
PHP
8.4
License
AGPL-3.0
Release page
GitHub

New in 11.0.25

Oct 28, 2026

owncloud.online 11.0.25 is a security release. Revoking access and disconnecting a session now also end the sessions of sync clients, tokens no longer appear in plain text in the log, and the office app oco_office (Collabora Online with SecureView) is available from the marketplace starting with this release. To update from 11.0.24, run occ upgrade as usual; there are no database migrations. Back up first: the backup is the only way back to 11.0.24.

Security

  • A revoked app password, a revoked OAuth2 grant and disconnecting a session (Personal → Security → Sessions, "Disconnect") now end a sync client's session with its next request.
  • A password change ends the sessions of clients that log in with that password no later than last_check_timeout minutes after the change (default 5).
  • If a device was lost or credentials may have been compromised: change the password, disconnect all other sessions under "Sessions", revoke app passwords and OAuth2 grants, and disable the account for the time being if needed (documentation, in German: Fehlersuche → "Gerät verloren oder Zugangsdaten abgegriffen").
  • access_token, requesttoken and password now appear only as *** in the logged URL (log types owncloud and syslog). Tokens in the path of a URL and in message texts stay unchanged. Before you start using oco_office, rotate or clean up older logs as well as the access logs of the web server and of Collabora.

After the update

  • Sessions from before the update that send only the cookie, without an app password, log in again once.
  • App passwords that store a password from before a password change become invalid at the next check; these devices need a new app password. Accounts from LDAP and app passwords without a stored password are not affected; revoke them if needed.
  • Requests that send only the cookie to a session started with OAuth2 get HTTP 401. The desktop and mobile clients always send their token.
  • Every check with an outdated password is logged as "Login failed" and counts toward brute-force throttling. Right after the update and behind shared IP addresses (NAT), these entries can pile up, so check fail2ban rules that match "Login failed" beforehand.
  • If the LDAP server cannot be reached when a check is due, password sessions of sync clients that send only the cookie end; the clients then log in again.
  • For each device with an app password, the server checks the password every last_check_timeout minutes. With many devices, this adds some load.

New

  • The office app oco_office 0.4.2 (Collabora Online, SecureView with watermark) is available from the marketplace. It relies on the log masking and the new versions interface in this release and cannot be enabled on older versions.
  • For app developers: OCA\Files_Versions\Storage::skipNextVersion($path) skips the version for the next write. Custom token providers must implement the new method claimCredentialCheck of OC\Authentication\Token\IProvider.

Other fixes

  • New installations: the market app is enabled right away and checks the catalog once a day. On installations without internet access, set 'appstoreurl' => 'local' or disable the app with occ app:disable market.
  • Password reset: an error before the email is sent no longer blocks the next request.
  • A login form without a user name or password field no longer writes a PHP deprecation notice to the log.
  • 68 translated strings now name owncloud.online instead of old product names.

Full details: CHANGELOG.md in the repository.

All changes since 11.0.24Release 11.0.25 on GitHub

Files and checksums

FilePurposeSizeSHA-256
owncloud-online-11.0.25.tar.gzInstalling on a Linux server57.2 MBa82ce03c6449484d351cda3f3b9fe6bd8eac131b0f7a216ea644e423b8226b6c
owncloud-online-11.0.25.zipWeb hosting without root access64.5 MBfffcd1ea9025ea316c237beb750a2cdbdda0bc15c461244f82b24b8b275a73a9
sbom-owncloud-online-11.0.25.cdx.jsonSoftware bill of materials (SBOM, CycloneDX)44 KB0de851c61b429558c20a4bb86ca7417a3ccc8d45ffa23c9d6f34c1c6591af34b
release-manifest.jsonBuild details: version, commit, PHP552 B94faea80912d502f8e30adf6484c0d7d706a402fa7fc301cbbef671001610242
SHA256SUMS.txtChecksums of all packages383 B72ea31f4200f63c2035bce5d15814dc53ee8335532f8b47a98ee78486d493767

The SHA-256 checksum of the downloaded file must match the value in the table. If it does not, the file is incomplete or damaged.

Linux
sha256sum owncloud-online-11.0.25.tar.gz
macOS
shasum -a 256 owncloud-online-11.0.25.tar.gz
Windows
certutil -hashfile owncloud-online-11.0.25.zip SHA256

Installation and updates

Requirements

  • PHP 8.4 (8.4.27 or later), ideally with PHP-FPM
  • MariaDB or MySQL
  • Apache or Nginx
  • System cron for background jobs
  • APCu as the local cache, Redis for file locking
  • HTTPS in production

Updating

Back up the code, the data directory and the database before every update. Then replace the code and run occ upgrade. The backup is the only way back to the previous version.

Documentation (in German)

Older versions

11.0.24Oct 21, 2026

Release notes 11.0.24

owncloud.online 11.0.24 is a maintenance release with a security warning about PHP, fewer 503 errors under load and a log viewer in the settings. Updating from 11.0.23 needs no special steps (occ upgrade as usual).

Security

  • The setup warnings now flag PHP versions without the fixes for CVE-2026-109618 and CVE-2026-109619 (unauthenticated code execution in the PHP interpreter, published on October 21, 2026). Fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 and 8.6.0RC4. For PHP packages from a Linux distribution this is only a warning: once the distribution has shipped the fix, 'php_security_check' => false hides it.
  • PHP's upload progress tracking (session.upload_progress) is turned off in .user.ini (PHP-FPM) and .htaccess (Apache with mod_php, now also for PHP 8). To turn it off server-wide and right away, set session.upload_progress.enabled = Off in php.ini or in the FPM pool.
  • If a session fails to start, the log states the reason, without the session ID and without the storage path (Redis credentials).

Stability under load

  • No more "503 Internal Server Error" when sessions are stored in Redis and the session lock is taken (parallel PROPFIND requests from the desktop client after a bulk upload). A logged-in browser stays logged in when this happens.
  • A failing Redis used as a cache (memcache.local/memcache.distributed) no longer aborts requests. Redis for file locking still has to be reachable.
  • Token requests from OAuth2 clients (for example desktop client 6.0.3 with a session cookie) no longer count as failed logins and no longer slow down real logins.
  • WebDAV errors with status 503 now show their actual cause in the log. Expected client errors (for example 405 when creating a folder that already exists) are no longer logged as FATAL.

New

  • Settings → General → Log: read the latest entries directly, filter them (level, app) and search them, with details including the trace. Admins get the same data as JSON at /index.php/settings/admin/log/entries. Requires log_type owncloud.

Other fixes

  • After a failed delivery, "Request again" now resends the password reset email (fixes the known limitation from 11.0.23).
  • Previews no longer fail with HTTP 500 for version previews and broken images.
  • After an error, the update page now announces the message to screen readers.
  • es_AR and mk: the hint about sharing now uses the product name owncloud.online.

Full details: CHANGELOG.md in the repository.

All changes since 11.0.23Release 11.0.24 on GitHub

11.0.23Oct 16, 2026

Release notes 11.0.23

owncloud.online 11.0.23 is a maintenance release with fixes for login, accessibility and error handling. Updating from 11.0.22 needs no special steps (occ upgrade as usual).

Login and accessibility

  • The login card stays centered even when an app such as OAuth2 (desktop client) shows a notice. Text and password fields show a single, clear focus outline.
  • Windows contrast mode: buttons on the guest pages have a border, and the info dot in the OAuth2 notice is visible.
  • "Forgot password": success and error messages are announced to screen readers and receive focus. New "Request again" button, translated into all languages. The lockout notice also appears without "Stay logged in". Requests are no longer sent more than once.
  • "New password" page: correct labels, and errors are read out.
  • Update page: works with the keyboard, announces progress, and no longer links to external forums.

Error handling and fixes

  • Manipulated request parameters (for example redirect_url[]=…, requesttoken[]=…) no longer cause HTTP 500 on the login page, "Forgot password", two-factor login or the start page.
  • Instances with two web roots (for example / and /oc-shib behind Shibboleth): the login page loads its images through its own path.
  • No more error in the log when a file is deleted while its preview is being created.
  • Incomplete or misconfigured trusted_domains entries no longer break host detection, recipient search or signed URLs.
  • Files with an empty MIME type are treated as unknown; folder listings no longer need extra database queries for them.
  • No more deprecation notice when removing the email address or the display name.

Note for servers with the OAuth2 app from the marketplace

Please update OAuth2 to 0.9.0 (available in the marketplace). Older versions still answer manipulated login URLs with HTTP 500, and only 0.9.0 lets desktop clients redirect to their own loopback address (RFC 8252). Reload PHP-FPM after the app update.

Known limitation

  • "Forgot password": if sending mail fails on the server, "Request again" wrongly reports success within the next 5 minutes. This problem predates 11.0.23 and is fixed in 11.0.24. Workaround: make sure the server can send mail (Settings → General → Email server).

Full details: CHANGELOG.md in the repository.

All changes since 11.0.22Release 11.0.23 on GitHub

11.0.22Oct 2, 2026

Release notes 11.0.22

owncloud.online 11.0.22 is a maintenance release with fixes for the calendar, email addresses and German-language emails.

Security

  • An event with endless recurrences no longer takes down the whole calendar.
  • Calendar subscriptions are deleted together with the account.

Fixes

  • Events with an attendee address without a domain can be saved again.
  • A quoted local part containing "@" is kept intact in email addresses.
  • Emails in German end with a German signature instead of "Best regards".

Changes

  • Primary buttons use the brand color.

For developers

  • The check of the bundled Market copy (build/sync-market.sh --check) no longer trusts build/market.ref blindly.

Full details: CHANGELOG.md in the repository.

All changes since 11.0.21Release 11.0.22 on GitHub

11.0.21Sep 30, 2026

Release notes 11.0.21

owncloud.online 11.0.21 contains security fixes and bug fixes for uploads, cron and the upgrade.

Security

  • phpseclib updated to 3.0.57 (CVE-2026-84308).
  • The freely configurable instance name is escaped in the body class and in HTML emails.

Fixes

  • The cron run (occ system:cron) no longer aborts when a guest's file system was set up earlier and the certificate bundle had to be rebuilt.
  • For disabled apps, the upgrade only points to the marketplace if the marketplace offers them.
  • The web interface reports when the server stops assembling an upload.
  • No more PHP deprecation notice on every write by a user with a quota.
  • An upload in the browser that starts more than a minute after the previous one is no longer wrongly aborted and restarted.

Improvements

  • The page reloads after a theme is enabled or disabled.
  • New guide for migrating from the previous generation, including branding (docs/administration/migration.md).

Full details: CHANGELOG.md in the repository.

All changes since 11.0.20Release 11.0.21 on GitHub

11.0.20Sep 24, 2026

Release notes 11.0.20

owncloud.online 11.0.20 contains security fixes, makes large uploads in the browser more reliable and improves accessibility.

Security

  • The WebDAV permission check for PROPFIND never ran; it is now enforced.
  • occ config:*:set no longer prints secrets.
  • Select2: CVE-2016-10744 is closed at the point where text enters the HTML.
  • jQuery UI: fixes from 1.13.0 are backported, including the datepicker in js.js.
  • Market: local package sources are restricted to the catalog directory.
  • Group admin lists follow the allow_subadmins switch.
  • Home directory: a symbolic link in the path is detected.

Fixes

  • Large uploads in the browser survive individual failed chunks and state the cause.
  • A lost connection no longer reloads the page during an upload.
  • Assembling large uploads no longer depends on the browser's open connection.
  • The legacy OCS routes (provisioning and sharing API) no longer return empty responses when the route cache is filled.
  • During an upgrade, apps without code are only disabled if they are really missing.
  • Bitmap previews release the file even when an error occurs.

Changes

  • owncloud.log is rotated at 100 MB by default.
  • The market app 0.10.10 now comes only from its own repository.
  • Market: the JS bundle is rebuilt reproducibly from source.
  • The release build is protected against network problems and silent errors.

Accessibility

  • Better contrast, file actions as buttons, fixes for the favorite star.

Full details: CHANGELOG.md in the repository.

All changes since 11.0.19Release 11.0.20 on GitHub

11.0.19Sep 16, 2026

Release notes 11.0.19

owncloud.online 11.0.19 fixes an upgrade problem.

Fix

  • The upgrade no longer aborts when enabled apps have no code. Those apps are disabled instead.

Full details: CHANGELOG.md in the repository.

All changes since 11.0.18Release 11.0.19 on GitHub

11.0.18Sep 10, 2026

There are no release notes for this version.

All changes since 11.0.17Release 11.0.18 on GitHub

11.0.17Aug 26, 2026

There are no release notes for this version.

All changes since 11.0.15Release 11.0.17 on GitHub

11.0.15Aug 24, 2026

There are no release notes for this version.

All changes since 11.0.14Release 11.0.15 on GitHub

11.0.14Aug 20, 2026

There are no release notes for this version.

Release 11.0.14 on GitHub

All versions on GitHub

As of Oct 29, 2026, 6:08 AM (Berlin time) · Source: GitHub releases