ownCloud Web 12.4.1 ships with a priority fix: an embed mode postMessage vulnerability that let a malicious page forge authenticated file writes without user interaction. If you run embed mode, update. Seven bugfixes round out the release, four of them in vault mode.