CVE-2026-77633 Details
Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0.
A storage-quota bypass vulnerability has been identified in Cloudreve, a self-hosted file management system, in versions prior to 4.18.0. The issue arises from a Time-of-Check to Time-of-Use (TOCTOU) race condition in the file upload process. The 'PrepareUpload' function in the 'pkg/filemanager/fs/dbfs/upload.go' file checks a user's storage capacity and applies a storage charge in two separate, non-atomic steps. This allows authenticated users with 'Files.Write' permission to exploit the vulnerability by concurrently initiating multiple upload sessions that exceed their allocated storage quota. The excess storage is then written to the host's disk, filling up available space and disrupting uploads for other users.
Users can upgrade to Cloudreve version 4.18.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df | [email protected] | Source CodeVendor |
| https://github.com/cloudreve/cloudreve/releases/tag/4.18.0 | [email protected] | Release NotesVendor |
| https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cloudreve | <= 4.17.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | [email protected] |