CVE-2026-54563 Details
Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.
A path traversal vulnerability has been identified in Cloudreve WebDAV accounts prior to version 4.16.1. The issue arises because the WebDAV request handler does not properly validate the request paths before joining them with the account's root directory. This flaw allows a WebDAV account rooted in a specific folder to access files outside of that folder. Additionally, if the WebDAV account has writable credentials, it can create, overwrite, move, or delete files outside the designated directory. The vulnerability is contained within the same user's namespace and does not affect other users' files or the operating system's filesystem.
Users are advised to update to Cloudreve version 4.16.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cloudreve | < 4.16.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |