Read the docs
TI-2026-54104 Aliases CVE-2026-77633GHSA-xj3h-wwxq-gfcj

Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

Priority LOW 31CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Fixed cloudreve (cloudreve): 4.18.0github.com/cloudreve/Cloudreve/v4 (Go): 4.0.0-20260715025621-7329602751c0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cloudrevecloudrevebefore 4.18.04.18.0Patch availableCNA
—github.com/cloudreve/Cloudreve/v4 (Go)before 4.0.0-20260715025621-7329602751c04.0.0-20260715025621-7329602751c0Patch availableGHSA-xj3h-wwxq-gfcj
  • cloudreve Vendorcloudreve Affected before 4.18.0 Fixed in 4.18.0 Patch available CNA
  • github.com/cloudreve/Cloudreve/v4 (Go) Vendor— Affected before 4.0.0-20260715025621-7329602751c0 Fixed in 4.0.0-20260715025621-7329602751c0 Patch available GHSA-xj3h-wwxq-gfcj

Remediation

  • Fix · CNA cloudreve (cloudreve) Fixed in 4.18.0
  • Fix · GHSA-xj3h-wwxq-gfcj github.com/cloudreve/Cloudreve/v4 (Go) Fixed in 4.0.0-20260715025621-7329602751c0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77633
  2. 2026-10-03 Alias added: GHSA-xj3h-wwxq-gfcj

References

Advisory 1

Other 4

  • TI-2026-65089 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint CVSS 4.0MEDIUM 6.9
  • TI-2026-39397 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim CVSS 3.1HIGH 7.6
  • TI-2026-40054 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials CVSS 3.1HIGH 7.1
  • TI-2026-39400 Incorrect authorization in cloudreve CVSS 3.1HIGH 7.1
  • TI-2026-40050 Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS) CVSS 3.1MEDIUM 6.5
  • TI-2026-39399 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses CVSS 3.1MEDIUM 6.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences