Read the docs
TI-2026-65084 Aliases CVE-2026-101051GHSA-wv98-qffc-cvmj

Cloudreve before 4.16.1 Path Traversal via Remote Download

Priority MEDIUM 45CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations within accessible namespaces.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00255 17th percentileScored 2026-11-07
Fix Fixed cloudreve (cloudreve): 4.16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cloudrevecloudrevebefore 4.16.14.16.1Patch availableCNA
  • cloudreve Vendorcloudreve Affected before 4.16.1 Fixed in 4.16.1 Patch available CNA

Remediation

  • Fix · CNA cloudreve (cloudreve) Fixed in 4.16.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    cloudreve 4.16.1

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-65089 Cloudreve before 4.16.1 Authentication Bypass via Cached Context HintPriority HIGH 70
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101051
  2. 2026-10-03 Alias added: GHSA-wv98-qffc-cvmj

References

Advisory 1

  • TI-2026-65089 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint CVSS 4.0MEDIUM 6.9
  • TI-2026-39397 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim CVSS 3.1HIGH 7.6
  • TI-2026-40054 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials CVSS 3.1HIGH 7.1
  • TI-2026-39400 Incorrect authorization in cloudreve CVSS 3.1HIGH 7.1
  • TI-2026-40050 Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS) CVSS 3.1MEDIUM 6.5
  • TI-2026-39399 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses CVSS 3.1MEDIUM 6.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences