CVE-2026-54563
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In Cloudreve prior to version 4.16.1, a WebDAV account scoped to a configured folder can bypass the restriction by sending paths containing encoded ".." characters (e.g., %2e%2e). The stripPrefix function in pkg/webdav/webdav.go joins the decoded request suffix to the account root without checking containment, allowing reading and listing files outside the folder, and for writable accounts also creating, overwriting, moving, or deleting them.
Risk Assessment
The organization is at risk of unauthorized access to files outside the configured WebDAV folder, potentially leading to data leakage or modification by a user with a restricted account.
Recommendation
Immediately update Cloudreve to version 4.16.1 or later, which includes a fix for the path traversal vulnerability in WebDAV.
Other vulnerabilities in Cloudreve
See all- CVE-2026-62323Medium
In Cloudreve before version 4.17.0, WOPI session validation uses only the session-id prefix of the access token and does not enforce the requested action, allowing a malicious viewer to forge the token suffix and invoke file write operations.
- CVE-2026-55502High
Vulnerability in Cloudreve before 4.17.0, where the POST /api/v4/admin/policy/oauth/signin endpoint requires only Admin.Read permission but allows modification of OneDrive storage policy credentials without Admin.Write, enabling changes to secret and app_id.
- CVE-2026-55499Medium
In Cloudreve before version 4.17.0, a single-file share event-stream subscription resolves the share root to the owner's parent folder and subscribes to it, allowing an authenticated share recipient to receive information about unshared sibling files and folders.
- CVE-2026-55497Medium
Cloudreve before version 4.17.0 has a vulnerability in thumbnail and avatar decoders that limit compressed file size but not decoded pixel dimensions. An authenticated user can submit a small PNG, JPEG, or GIF that triggers unbounded memory allocation and terminates the Cloudreve process due to an out-of-memory error.
- CVE-2026-55496Medium
Cloudreve before version 4.17.0 has a vulnerability in the GET /api/v4/user/search endpoint that calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser. This allows any logged-in user to enumerate email addresses and profile metadata for inactive or banned accounts.
- CVE-2026-55495Medium
Cloudreve before version 4.17.0 has a vulnerability in the WOPI PUT_RELATIVE handler that passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename. This allows slash and dot-dot segments to escape the source file directory and create or conditionally overwrite files elsewhere in the same owner account.
- CVE-2026-54562Medium
Cloudreve before version 4.16.1 allows non-admin users with remote download permission to fetch internal-only URLs (e.g., localhost, loopback) via the POST /api/v4/workflow/download endpoint. The vulnerability is due to missing blocking of loopback, localhost, IPv6 localhost, and redirect-to-loopback targets.
- CVE-2026-54560High
Cloudreve versions 4.12.0 through 4.16.1 issue OAuth access tokens without the client_id claim, causing the JWT verifier to not load token scopes into the request context. The RequiredScopes function treats such requests as non-scoped session authentication, allowing a low-scope OAuth token to call APIs requiring higher scopes, including file, share, workflow, user settings, WebDAV accounts, and potentially admin scopes.
- CVE-2026-25726High
Vulnerability in Cloudreve (self-hosted file management and sharing system) before version 4.13.0. The application uses a weak PRNG (math/rand) seeded with admin account creation time. An attacker can recover the secret_key and forge JWT tokens, leading to admin account takeover.
Original NVD description (English source)
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.