CVE-2026-45727 Details
Description
CloakBrowser is a tool to bypass bot detection tests. Prior to version 0.3.28, the cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted fingerprint value containing path traversal sequences to resolve user_data_dir outside the configured data_dir. When Chrome fails to start or the process is cleaned up, shutil.rmtree() deletes the traversed path, resulting in arbitrary directory deletion. Additionally, cloakserve bound to 0.0.0.0 by default, making it network-exposed. This issue has been patched in version 0.3.28.
A path traversal vulnerability has been identified in CloakBrowser versions through 0.3.27. The issue arises in the cloakserve CDP multiplexer, which uses the user-supplied fingerprint query parameter as a filesystem path component for creating Chrome profile directories. An unauthenticated attacker with access to the cloakserve port can inject crafted fingerprint values containing path traversal sequences. This manipulation can redirect the user_data_dir outside the designated data_dir. When the Chrome process fails to start or is terminated, the shutil.rmtree() function deletes the traversed path, causing arbitrary directory deletion. Additionally, cloakserve is bound to 0.0.0.0 by default, exposing it to the network.
Users are advised to upgrade to CloakBrowser version 0.3.28 or later and restrict network access to the cloakserve port.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 1, 2026CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CloakHQ/CloakBrowser/security/advisories/GHSA-mf33-gv72-w2h5 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CloakHQ CloakBrowser | <= 0.3.27 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |