CVE-2026-77633
HighCVSS 7.1Summary
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload checks a stale in-memory user storage value and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff, exceeding the account quota and exhausting host storage.
Risk Assessment
An attacker can exhaust host storage, causing denial of uploads for other users. This may lead to service unavailability and breach of system integrity.
Recommendation
Update Cloudreve to version 4.18.0 or later. Until then, monitor for unusual upload patterns and consider restricting Files.Write permissions.
Other vulnerabilities in Cloudreve
See all- CVE-2026-79913Medium
In Cloudreve prior to 4.18.0, the ValidateExternalURL server-side request forgery (SSRF) guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4.
- CVE-2026-77637Low
Cloudreve before version 4.18.0 lacks the RequiredScopes(types.ScopeAdminWrite) middleware on tool.GET("wopi") and tool.POST("mail") routes, which inherit ScopeAdminRead. An OAuth application or API key with Admin.Read can probe configured WOPI endpoints and send arbitrary test emails via the server SMTP configuration, exceeding read-only authorization boundaries.
- CVE-2026-62323Medium
In Cloudreve before version 4.17.0, WOPI session validation uses only the session-id prefix of the access token and does not enforce the requested action, allowing a malicious viewer to forge the token suffix and invoke file write operations.
- CVE-2026-55502High
Vulnerability in Cloudreve before 4.17.0, where the POST /api/v4/admin/policy/oauth/signin endpoint requires only Admin.Read permission but allows modification of OneDrive storage policy credentials without Admin.Write, enabling changes to secret and app_id.
- CVE-2026-55499Medium
In Cloudreve before version 4.17.0, a single-file share event-stream subscription resolves the share root to the owner's parent folder and subscribes to it, allowing an authenticated share recipient to receive information about unshared sibling files and folders.
- CVE-2026-55497Medium
Cloudreve before version 4.17.0 has a vulnerability in thumbnail and avatar decoders that limit compressed file size but not decoded pixel dimensions. An authenticated user can submit a small PNG, JPEG, or GIF that triggers unbounded memory allocation and terminates the Cloudreve process due to an out-of-memory error.
- CVE-2026-55496Medium
Cloudreve before version 4.17.0 has a vulnerability in the GET /api/v4/user/search endpoint that calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser. This allows any logged-in user to enumerate email addresses and profile metadata for inactive or banned accounts.
- CVE-2026-55495Medium
Cloudreve before version 4.17.0 has a vulnerability in the WOPI PUT_RELATIVE handler that passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename. This allows slash and dot-dot segments to escape the source file directory and create or conditionally overwrite files elsewhere in the same owner account.
- CVE-2026-54563High
In Cloudreve prior to version 4.16.1, a WebDAV account scoped to a configured folder can bypass the restriction by sending paths containing encoded ".." characters (e.g., %2e%2e). The stripPrefix function in pkg/webdav/webdav.go joins the decoded request suffix to the account root without checking containment, allowing reading and listing files outside the folder, and for writable accounts also creating, overwriting, moving, or deleting them.
- CVE-2026-54562Medium
Cloudreve before version 4.16.1 allows non-admin users with remote download permission to fetch internal-only URLs (e.g., localhost, loopback) via the POST /api/v4/workflow/download endpoint. The vulnerability is due to missing blocking of loopback, localhost, IPv6 localhost, and redirect-to-loopback targets.
Original NVD description (English source)
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS