Read the docs
TI-2026-39400 Aliases CVE-2026-54563GHSA-w5fv-7x5q-g8qp

Incorrect authorization in cloudreve

Priority MEDIUM 64CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Fixed cloudreve (cloudreve): 4.16.1github.com/cloudreve/Cloudreve/v4 (Go): 4.0.0-20260606032813-26b6b1044b02

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cloudrevecloudrevebefore 4.16.14.16.1Patch availableCNA
—github.com/cloudreve/Cloudreve/v4 (Go)before 4.0.0-20260606032813-26b6b1044b024.0.0-20260606032813-26b6b1044b02Patch availableGHSA-w5fv-7x5q-g8qp
—github.com/cloudreve/Cloudreve/v3 (Go)up to 3.0.0-20250225100611-da4e44b77af4—No fix listedGHSA-w5fv-7x5q-g8qp
  • cloudreve Vendorcloudreve Affected before 4.16.1 Fixed in 4.16.1 Patch available CNA
  • github.com/cloudreve/Cloudreve/v4 (Go) Vendor— Affected before 4.0.0-20260606032813-26b6b1044b02 Fixed in 4.0.0-20260606032813-26b6b1044b02 Patch available GHSA-w5fv-7x5q-g8qp
  • github.com/cloudreve/Cloudreve/v3 (Go) Vendor— Affected up to 3.0.0-20250225100611-da4e44b77af4 Fixed in — No fix listed GHSA-w5fv-7x5q-g8qp

Remediation

  • Fix · CNA cloudreve (cloudreve) Fixed in 4.16.1
  • Fix · GHSA-w5fv-7x5q-g8qp github.com/cloudreve/Cloudreve/v4 (Go) Fixed in 4.0.0-20260606032813-26b6b1044b02 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54563
  2. 2026-10-03 Alias added: GHSA-w5fv-7x5q-g8qp

References

Advisory 1

Other 3

  • TI-2026-65089 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint CVSS 4.0MEDIUM 6.9
  • TI-2026-39397 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim CVSS 3.1HIGH 7.6
  • TI-2026-40054 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials CVSS 3.1HIGH 7.1
  • TI-2026-40050 Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS) CVSS 3.1MEDIUM 6.5
  • TI-2026-39399 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses CVSS 3.1MEDIUM 6.5
  • TI-2026-44495 Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored CVSS 3.1MEDIUM 6.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences