An ownCloud Classic (OC10) app that integrates ClamAV antivirus scanning into the file upload pipeline. Files are scanned at upload time; infected files are automatically deleted and users are notified on screen and via email. The app supports ClamAV in executable mode, network daemon mode, and local socket mode, and includes a background job for scanning existing files.
Requirements: ClamAV (binaries or a ClamAV daemon).
Enable the app and configure ClamAV mode in the ownCloud admin settings:
sudo -u www-data php occ app:enable files_antivirusConfigure the connection mode (executable, socket, or network) in the admin panel under the Antivirus section.
Capabilities of the antivirus integration:
- Executable mode -- uses the ClamAV binary directly
- Daemon mode (network socket) -- connects to a remote/local ClamAV daemon via network
- Daemon mode (local socket) -- connects via local file socket
- Background job -- scans all existing files on a schedule
The Enterprise Edition supports the ICAP protocol for integration with commercial antivirus solutions:
| Vendor | Request Service | Response Header |
|---|---|---|
| ClamAV (c-icap) | avscan |
X-Infection-Found |
| Kaspersky ScanEngine | req |
X-Virus-ID |
| FortiSandbox | respmod |
X-Virus-Name |
| McAfee/Skyhigh Web Gateway 10.x+ | respmod |
X-Virus-Name |
ICAP mode requires a valid enterprise license. Without a license key, it triggers a grace period; after expiration the app is disabled.
- Files are checked at upload time
- Infected files are automatically deleted with on-screen and email notification
- Configurable file size limit
- Background job for full-filesystem scanning
- Tested on Linux
This app extends ownCloud Server with antivirus scanning capabilities. It is shipped as part of the ownCloud Server Docker image.
Star this repo and Watch for release notifications!
We welcome contributions! Please read the Contributing Guidelines and our Code of Conduct before getting started.
- Rebase Early, Rebase Often! We use a rebase workflow. Always rebase on the target branch before submitting a PR.
- Dependabot: Automated dependency updates are managed via Dependabot. Review and merge dependency PRs promptly.
- Signed Commits: All commits must be PGP/GPG signed. See GitHub's signing guide.
- DCO Sign-off: Every commit must carry a
Signed-off-byline:git commit -s -S -m "your commit message" - GitHub Actions Policy: Workflows may only use actions that are (a) owned by
owncloud, (b) created by GitHub (actions/*), or (c) verified in the GitHub Marketplace.
Help translate this project on Transifex: https://explore.transifex.com/owncloud-org/owncloud/
Please submit translations via Transifex -- do not open pull requests for translation changes.
Do not open a public GitHub issue for security vulnerabilities.
Report vulnerabilities at https://security.owncloud.com -- see SECURITY.md.
Bug bounty: YesWeHack ownCloud Program
This project is licensed under the AGPL-3.0.
The Kiteworks Open Source Program Office, operating under the ownCloud brand, launched on May 5, 2026, to steward the open source ecosystem around ownCloud's products. The OSPO ensures transparent governance, license compliance, community health, and sustainable collaboration between the open source community and Kiteworks, which acquired ownCloud in 2023.
- OSPO Home: https://kiteworks.com/opensource
- GitHub: https://github.com/owncloud
- ownCloud: https://owncloud.com
For questions about the OSPO or licensing, contact ospo@kiteworks.com.
The OSPO is driving a strategic relicensing of ownCloud repositories toward the Apache License 2.0, following the Apache Software Foundation's third-party license policy.
Individual repositories will migrate as their audit is completed. The LICENSE file in each repo reflects its current license status (not the target).
Current license: AGPL-3.0 (Category X per Apache policy -- cannot be included in Apache-2.0 works).
Migration prerequisites for this repository:
- CLA/DCO coverage: All past contributors must have signed agreements permitting relicensing
- Copyleft dependency audit: All AGPL/GPL dependencies must be replaced or isolated
- KDE heritage review: Any code with KDE-era copyrights requires legal analysis
- Complete relicensing: AGPL-3.0 is a strong copyleft license; migration requires full relicensing of all files, not just a header change