PT-2026-60182 · Cloudreve · Cloudreve

CVE-2026-54563 · Published 2026-07-15 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.16.1

Description Cloudreve is a self-hosted file management and sharing system. A flaw exists where a WebDAV account rooted at a configured folder can access files outside that directory by sending paths such as '/dav/%2e%2e/outside.txt'. This occurs because the stripPrefix function in pkg/webdav/webdav.go uses fs.URI.JoinRaw to join the decoded request suffix to the account root without verifying containment. Consequently, scoped credentials can read and list files outside the intended folder, and writable credentials can create, overwrite, move, or delete them.

Recommendations Update to version 4.16.1.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-54563

GHSA-W5FV-7X5Q-G8QP

Affected Products

Cloudreve

References · 4

• 🔥 https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54563.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-54563 · Security Note
• https://osv.dev/vulnerability/CVE-2026-54563 · Vendor Advisory