CVE-2026-101051Low· 3.1▾ TwilightPoC availableCloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in down…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 17.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
Exploit / PoC code exists
0.2%
0.2% → 0.3%
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations within accessible namespaces.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/cloudreve/Cloudreve/v4 <= 4.0.0-20260606032813-26b6b1044b02Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101056Medium· 5.3Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID
CVE-2026-101048Medium· 5.4Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete route…
CVE-2026-79913Medium· 6.5Cloudreve is a self-hosted file management and sharing system
CVE-2026-77633High· 7.1Cloudreve is a self-hosted file management and sharing system
CVE-2026-77637Low· 3.8Cloudreve is a self-hosted file management and sharing system
GHSA-w8j7-39hp-8x59MediumCloudreve's remote download file paths can escape the selected destination directory