oc-tmueller · Oct 27, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## 2026-10-22
+
+* Security
+  * Hardened PHP's request parsing as recommended after CVE-2026-109618 and
+    CVE-2026-109619: `post_max_size` now defaults to `100M`, configurable with
+    the new `OWNCLOUD_POST_MAX_SIZE` and enforced with `php_admin_value`, so
+    ownCloud's `.htaccess` can no longer raise it to 513M. It used to follow
+    `OWNCLOUD_MAX_UPLOAD` (20G). `max_input_nesting_level` is lowered from 64 to
+    6, and `expose_php = Off` is now set explicitly; Ubuntu's `php.ini` already
+    had it off. `session.upload_progress.enabled` is off: the advisory names it as
+    an attack path, and ownCloud does not use it. File uploads use WebDAV `PUT`
+    and are not affected
+
 ## 2026-08-18
 
 * Fixed

diff --git a/ENVIRONMENT.md b/ENVIRONMENT.md
@@ -242,7 +242,7 @@
 - `OWNCLOUD_MAX_INPUT_TIME=3600` \
   Sets PHP option `max_input_time`. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)).
 - `OWNCLOUD_MAX_UPLOAD=20G` \
-  Sets PHP option `upload_max_filesize` and `post_max_size`. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)).
+  Sets PHP option `upload_max_filesize`. On ownCloud 10 the web server uses 513M instead, because ownCloud's `.htaccess` sets it. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)).
 - `OWNCLOUD_MEMORY_LIMIT=512M` \
   Sets PHP option `memory_limit`. It is recommended to keep the default (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/big_file_upload_configuration.html#configuring-via-php-global-settings)).
 - `OWNCLOUD_MINIMUM_SUPPORTED_DESKTOP_VERSION=` \
@@ -300,6 +300,8 @@
   Path to custom scripts that need to be executed after a cron run.
 - `OWNCLOUD_POST_INSTALL_PATH=/etc/post_install.d` \
   Path to custom scripts that need to be executed after an ownCoud installation command.
+- `OWNCLOUD_POST_MAX_SIZE=100M` \
+  Sets PHP option `post_max_size`, the size limit for form and multipart POST bodies that PHP parses. File uploads go through WebDAV `PUT` and are not affected, and the body of other POST requests is still readable. Keep it below a quarter of PHP's `memory_limit`, so that parsing a large request cannot reach it. That is `OWNCLOUD_MEMORY_LIMIT` on ownCloud 11, but on ownCloud 10 the web server always uses 512M, because ownCloud's `.htaccess` sets it.
 - `OWNCLOUD_POST_SERVER_PATH=/etc/post_server.d` \
   Path to custom scripts that need to be executed after an ownCloud server startup.
 - `OWNCLOUD_PREVIEW_JPEG_IMAGE_DISPLAY_QUALITY=` \

diff --git a/v22.04/overlay/etc/entrypoint.d/10-base.sh b/v22.04/overlay/etc/entrypoint.d/10-base.sh
@@ -40,6 +40,9 @@ declare -x OWNCLOUD_POST_CRONJOB_PATH
 declare -x OWNCLOUD_MAX_UPLOAD
 [[ -z "${OWNCLOUD_MAX_UPLOAD}" ]] && OWNCLOUD_MAX_UPLOAD="20G"
 
+declare -x OWNCLOUD_POST_MAX_SIZE
+[[ -z "${OWNCLOUD_POST_MAX_SIZE}" ]] && OWNCLOUD_POST_MAX_SIZE="100M"
+
 declare -x OWNCLOUD_MEMORY_LIMIT
 [[ -z "${OWNCLOUD_MEMORY_LIMIT}" ]] && OWNCLOUD_MEMORY_LIMIT="512M"
 

diff --git a/v22.04/overlay/etc/php/7.4/mods-available/owncloud.ini b/v22.04/overlay/etc/php/7.4/mods-available/owncloud.ini
@@ -3,12 +3,16 @@ variables_order = "EGPCS"
 apc.enable_cli = 1
 
 upload_max_filesize = "20G"
-post_max_size = "20G"
+post_max_size = "100M"
 
 max_execution_time = 3600
 max_input_time = 3600
 
 default_socket_timeout = 60
 
+expose_php = Off
+max_input_nesting_level = 6
+session.upload_progress.enabled = Off
+
 session.save_handler = "files"
 session.save_path = "/mnt/data/sessions"
diff --git a/v22.04/overlay/etc/templates/apache.conf.tmpl b/v22.04/overlay/etc/templates/apache.conf.tmpl
@@ -21,5 +21,8 @@
     AllowOverride All
     Options -Indexes +FollowSymlinks
     LimitRequestBody 0
+    # php_admin_value: ownCloud's .htaccess sets php_value post_max_size, which
+    # would otherwise win over php.ini
+    php_admin_value post_max_size "{{ .Env.OWNCLOUD_POST_MAX_SIZE }}"
   </Directory>
 </VirtualHost>
diff --git a/v22.04/overlay/etc/templates/owncloud.ini.tmpl b/v22.04/overlay/etc/templates/owncloud.ini.tmpl
@@ -3,14 +3,18 @@ variables_order = "EGPCS"
 apc.enable_cli = 1
 
 upload_max_filesize = "{{ .Env.OWNCLOUD_MAX_UPLOAD }}"
-post_max_size = "{{ .Env.OWNCLOUD_MAX_UPLOAD }}"
+post_max_size = "{{ .Env.OWNCLOUD_POST_MAX_SIZE }}"
 memory_limit = "{{ .Env.OWNCLOUD_MEMORY_LIMIT }}"
 
 max_execution_time = {{ .Env.OWNCLOUD_MAX_EXECUTION_TIME }}
 max_input_time = {{ .Env.OWNCLOUD_MAX_INPUT_TIME }}
 
 default_socket_timeout = {{ .Env.OWNCLOUD_DEFAULT_SOCKET_TIMEOUT }}
 
+expose_php = Off
+max_input_nesting_level = 6
+session.upload_progress.enabled = Off
+
 session.save_handler = "{{ .Env.OWNCLOUD_SESSION_SAVE_HANDLER }}"
 session.save_path = "{{ .Env.OWNCLOUD_SESSION_SAVE_PATH }}"
 {{- if eq .Env.OWNCLOUD_SESSION_SAVE_HANDLER "redis" }}

diff --git a/v24.04/overlay/etc/entrypoint.d/10-base.sh b/v24.04/overlay/etc/entrypoint.d/10-base.sh
@@ -40,6 +40,9 @@ declare -x OWNCLOUD_POST_CRONJOB_PATH
 declare -x OWNCLOUD_MAX_UPLOAD
 [[ -z "${OWNCLOUD_MAX_UPLOAD}" ]] && OWNCLOUD_MAX_UPLOAD="20G"
 
+declare -x OWNCLOUD_POST_MAX_SIZE
+[[ -z "${OWNCLOUD_POST_MAX_SIZE}" ]] && OWNCLOUD_POST_MAX_SIZE="100M"
+
 declare -x OWNCLOUD_MEMORY_LIMIT
 [[ -z "${OWNCLOUD_MEMORY_LIMIT}" ]] && OWNCLOUD_MEMORY_LIMIT="512M"
 

diff --git a/v24.04/overlay/etc/php/8.3/mods-available/owncloud.ini b/v24.04/overlay/etc/php/8.3/mods-available/owncloud.ini
@@ -3,12 +3,16 @@ variables_order = "EGPCS"
 apc.enable_cli = 1
 
 upload_max_filesize = "20G"
-post_max_size = "20G"
+post_max_size = "100M"
 
 max_execution_time = 3600
 max_input_time = 3600
 
 default_socket_timeout = 60
 
+expose_php = Off
+max_input_nesting_level = 6
+session.upload_progress.enabled = Off
+
 session.save_handler = "files"
 session.save_path = "/mnt/data/sessions"
diff --git a/v24.04/overlay/etc/templates/apache.conf.tmpl b/v24.04/overlay/etc/templates/apache.conf.tmpl
@@ -21,5 +21,8 @@
     AllowOverride All
     Options -Indexes +FollowSymlinks
     LimitRequestBody 0
+    # php_admin_value: ownCloud's .htaccess sets php_value post_max_size, which
+    # would otherwise win over php.ini
+    php_admin_value post_max_size "{{ .Env.OWNCLOUD_POST_MAX_SIZE }}"
   </Directory>
 </VirtualHost>
diff --git a/v24.04/overlay/etc/templates/owncloud.ini.tmpl b/v24.04/overlay/etc/templates/owncloud.ini.tmpl
@@ -3,14 +3,18 @@ variables_order = "EGPCS"
 apc.enable_cli = 1
 
 upload_max_filesize = "{{ .Env.OWNCLOUD_MAX_UPLOAD }}"
-post_max_size = "{{ .Env.OWNCLOUD_MAX_UPLOAD }}"
+post_max_size = "{{ .Env.OWNCLOUD_POST_MAX_SIZE }}"
 memory_limit = "{{ .Env.OWNCLOUD_MEMORY_LIMIT }}"
 
 max_execution_time = {{ .Env.OWNCLOUD_MAX_EXECUTION_TIME }}
 max_input_time = {{ .Env.OWNCLOUD_MAX_INPUT_TIME }}
 
 default_socket_timeout = {{ .Env.OWNCLOUD_DEFAULT_SOCKET_TIMEOUT }}
 
+expose_php = Off
+max_input_nesting_level = 6
+session.upload_progress.enabled = Off
+
 session.save_handler = "{{ .Env.OWNCLOUD_SESSION_SAVE_HANDLER }}"
 session.save_path = "{{ .Env.OWNCLOUD_SESSION_SAVE_PATH }}"
 {{- if eq .Env.OWNCLOUD_SESSION_SAVE_HANDLER "redis" }}