Priority HIGH 70
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00195 · Published 2026-09-27 · Fixed in 4.16.1 CWE-863
Priority HIGH 68
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.00582 · Published 2026-07-15 · Fixed in 4.16.1, 4.0.0-20260606015557-ed20843dc3df CWE-863
Priority MEDIUM 64
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00338 · Published 2026-07-31 · Fixed in 4.17.0 CWE-863
Priority MEDIUM 64
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00315 · Published 2026-07-15 · Fixed in 4.16.1, 4.0.0-20260606032813-26b6b1044b02 CWE-863
Priority MEDIUM 62
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0053 · Published 2026-07-31 · Fixed in 4.17.0, 4.0.0-20260613024411-3607f79bb44c CWE-400
Priority MEDIUM 62
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00402 · Published 2026-07-15 · Fixed in 4.16.1, 4.0.0-20260606025411-aaebf317a78f CWE-918
Priority MEDIUM 61
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · User interaction · EPSS 0.00306 · Published 2026-07-31 · Fixed in 4.17.0, 4.0.0-20260626022433-f3347130ac48 CWE-863
Priority MEDIUM 58
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00557 · Published 2022-09-20 · Fixed in 3.6.0-beta1 CWE-79
Priority MEDIUM 57
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/up…
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00235 · Published 2026-09-27 · Fixed in 4.17.0 CWE-863
Priority MEDIUM 53
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00331 · Published 2026-07-31 · Fixed in 4.17.0, 4.0.0-20260613030215-0b00dd308f13 CWE-863
Priority MEDIUM 53
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00361 · Published 2026-07-31 · Fixed in 4.0.0-20260613023921-7e1289d55279 CWE-200
Priority MEDIUM 53
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00376 · Published 2026-07-31 · Fixed in 4.17.0, 4.0.0-20260613023150-7968e50429ef CWE-22
Priority MEDIUM 45
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00255 · Published 2026-09-27 · Fixed in 4.16.1 CWE-22
Priority MEDIUM 43
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00391 · Published 2026-04-03 · Fixed in 4.13.0, 4.0.0-20260205113604-ec9fdd33bc54 CWE-338
Priority LOW 31
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00368 · Published 2026-09-22 · Fixed in 4.18.0, 4.0.0-20260715025621-7329602751c0 CWE-362
Priority LOW 29
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00402 · Published 2026-09-22 · Fixed in 4.18.0, 4.0.0-20260715072853-1c5cad6dec7e CWE-697
Priority LOW 18
Cloudreve is a self-hosted file management and sharing system.
CVSS 3.1LOW 3.8· Network · High privileges · No interaction · EPSS 0.00326 · Published 2026-09-22 · Fixed in 4.18.0, 4.0.0-20260715070110-bce08f88e9d8 CWE-862
THREATIST.IORead the docs