Read the docs
TI-2026-33465 Aliases CVE-2026-45727GHSA-mf33-gv72-w2h5

Path traversal in CloakHQ CloakBrowser

Priority MEDIUM 45CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

CloakBrowser is a tool to bypass bot detection tests. Prior to version 0.3.28, the cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted fingerprint value containing path traversal sequences to resolve user_data_dir outside the configured data_dir. When Chrome fails to start or the process is cleaned up, shutil.rmtree() deletes the traversed path, resulting in arbitrary directory deletion. Additionally, cloakserve bound to 0.0.0.0 by default, making it network-exposed. This issue has been patched in version 0.3.28.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00475 41st percentileScored 2026-11-07
Fix Fixed CloakBrowser (CloakHQ): 0.3.28cloakbrowser (PyPI): 0.3.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CloakHQCloakBrowserbefore 0.3.280.3.28Patch availableCNA
—cloakbrowser (PyPI)before 0.3.280.3.28Patch availableGHSA-mf33-gv72-w2h5
  • CloakBrowser VendorCloakHQ Affected before 0.3.28 Fixed in 0.3.28 Patch available CNA
  • cloakbrowser (PyPI) Vendor— Affected before 0.3.28 Fixed in 0.3.28 Patch available GHSA-mf33-gv72-w2h5

Remediation

  • Fix · CNA CloakBrowser (CloakHQ) Fixed in 0.3.28
  • Fix · GHSA-mf33-gv72-w2h5 cloakbrowser (PyPI) Fixed in 0.3.28 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45727
  2. 2026-10-03 Alias added: GHSA-mf33-gv72-w2h5
  3. 2026-10-14 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences