PT-2026-41798 · Cloakhq+2 · Cloakbrowser

0Xlally · Published 2026-05-18 · Updated 2026-06-01 · CVE-2026-45727

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CloakBrowser versions prior to 0.3.28

Description The cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker with network access to the cloakserve port can provide a crafted fingerprint value containing path traversal sequences to resolve user data dir outside the configured data dir. When Chrome fails to start or the process is cleaned up, the shutil.rmtree() function deletes the traversed path, leading to arbitrary directory deletion. By default, cloakserve is bound to 0.0.0.0, which makes it exposed to the network.

Recommendations Update to version 0.3.28. Restrict network access to the cloakserve port.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-45727

GHSA-MF33-GV72-W2H5

Affected Products

Cloakbrowser

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45727.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45727 · Security Note
• https://osv.dev/vulnerability/GHSA-mf33-gv72-w2h5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45727 · Vendor Advisory
• https://github.com/CloakHQ/CloakBrowser/security/advisories/GHSA-mf33-gv72-w2h5 · Note
• https://github.com/CloakHQ/CloakBrowser · Note