CVE-2026-54563 json
Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account root
published 2026-07-15 3 mo ago modified 2026-08-27 2 mo ago also GHSA-w5fv-7x5q-g8qp , GO-2026-6298 , EUVD-2026-44688
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.
Patch / fix
- go github.com/cloudreve/Cloudreve/v4 4.0.0-20260606032813-26b6b1044b02
- govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1
suse advisories SUSE-SU-2026:23625-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1
opensuse advisories openSUSE-SU-2026:21761-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/cloudreve/Cloudreve/v4 | <4.0.0-20260606032813-26b6b1044b02 |
4.0.0-20260606032813-26b6b1044b02 |
| go | github.com/cloudreve/Cloudreve/v3 | <=3.0.0-20250225100611-da4e44b77af4 all versions |
no fix listed |
| go | github.com/cloudreve/Cloudreve | all versions |
no fix listed |
Affected products
- cloudreve cloudreve
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
Sources
- CVE List CVE-2026-54563
- GitHub Advisory GHSA-w5fv-7x5q-g8qp
- NVD CVE-2026-54563
- OSV GO-2026-6298
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.