Security
فارسی
All products

github.com/cloudreve/Cloudreve

Go · Package
16 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth ScopeCVE-2026-77637 · GHSA-W89X-C962-C44GVersion ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go Low Fix reported
Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addressesCVE-2026-79913 · GHSA-JVH5-97XG-V99FVersion ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go Medium Fix reported
Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceCVE-2026-77633 · GHSA-XJ3H-WWXQ-GFCJVersion ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go High Fix reported
Cloudreve's remote download file paths can escape the selected destination directoryCVE-2026-101051 · GHSA-W8J7-39HP-8X59Version ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go Medium No fix reported
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hintCVE-2026-101056 · GHSA-VX2M-JPXR-XV7WVersion ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go Medium No fix reported
Cloudreve Admin.Read OAuth tokens can trigger server-side node test requestsCVE-2026-101048 · GHSA-V6W6-358X-2433Version ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go Medium Fix reported
Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account rootCVE-2026-54563 · GHSA-W5FV-7X5Q-G8QPVersion ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go High Fix reported
Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the serverCVE-2026-55497 · GHSA-G9J2-8W95-3VWVVersion ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go Medium Fix reported
Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblingsCVE-2026-55499 · GHSA-W8X7-H2PX-XMQ8Version ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go Medium Fix reported
Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emailsCVE-2026-55496 · GHSA-8R7F-R8HJ-R3RVVersion ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go Medium Fix reported
Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner AccountCVE-2026-55495 · GHSA-49H3-CWHJ-4737Version ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go Medium Fix reported
Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentialsCVE-2026-55502 · GHSA-HQ88-5X99-X3GFVersion ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go High Fix reported
Cloudreve WOPI view sessions can write files and WOPI access token secret is ignoredCVE-2026-62323 · GHSA-C3JM-GV5R-9WCPVersion ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go Medium Fix reported
Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claimCVE-2026-54560 · GHSA-VGJ4-345G-JCF8Version ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go High Fix reported
Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responsesCVE-2026-54562 · GHSA-X756-G4X3-C64MVersion ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go Medium Fix reported
Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)CVE-2026-25726 · GHSA-F8XP-WVCX-P6F4Version ranges need review. github.com/cloudreve/Cloudreve/v3github.com/cloudreve/Cloudreve/v4 Go High Fix reported