cloudreve has 22 CVEs on record. Disclosure cadence is accelerating: 18 in the last 90 days against 3 in the 90 before. The busiest recent month was July 2026 with 9. The median CVSS is 5.8 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-863 (9) and CWE-22 (3). Most affected products: github.com/cloudreve/Cloudreve/v4 (12), cloudreve (7), github.com/cloudreve/Cloudreve (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.8
- Publish → KEV
- —
- Last 90 days
- 18 prev 3
Products
- github.com/cloudreve/Cloudreve/v4 12
- cloudreve 7
- github.com/cloudreve/Cloudreve 3
Worst active — by depth score
CVE-2026-25726High· 8.1Cloudreve is a self-hosted file management and sharing system45CVE-2026-101048Medium· 5.4Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete route…42CVE-2026-54560High· 7.6Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim42CVE-2026-101056Medium· 5.3Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID41CVE-2026-77633High· 7.1Cloudreve is a self-hosted file management and sharing system39
cloudreve vulnerabilities
CVEs affecting cloudreve, newest first. Open any entry for full detail, references, and exploit status.
22 CVEsRSS
CVE-2026-101056Medium· 5.3PoCCloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 30…
CVE-2026-101048Medium· 5.4PoCCloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete route…
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete route…
CVE-2026-101051Low· 3.1PoCCloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in down…
CVE-2026-79913Medium· 6.5Cloudreve is a self-hosted file management and sharing system
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible…
CVE-2026-77633High· 7.1Cloudreve is a self-hosted file management and sharing system
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditiona…
CVE-2026-77637Low· 3.8Cloudreve is a self-hosted file management and sharing system
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to n…
CVE-2026-54563High· 7.1Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root
Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root
GO-2026-6289NoneCloudreve's remote download file paths can escape the selected destination directory in github.com/cloudreve/Cloudreve
Cloudreve's remote download file paths can escape the selected destination directory in github.com/cloudreve/Cloudreve
GO-2026-6287NoneCloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint in github.com/…
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint in github.com/cloudreve/Cloudreve
GHSA-vx2m-jpxr-xv7wMedium· 5.3Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint
GHSA-w8j7-39hp-8x59MediumCloudreve's remote download file paths can escape the selected destination directory
Cloudreve's remote download file paths can escape the selected destination directory
GO-2026-6106NoneCloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve
Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve
CVE-2026-55495Medium· 4.3Cloudreve is a self-hosted file management and sharing system
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape th…
CVE-2026-55496Medium· 4.3Cloudreve is a self-hosted file management and sharing system
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to …
CVE-2026-55497Medium· 6.5Cloudreve is a self-hosted file management and sharing system
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to subm…
CVE-2026-55499Medium· 4.3Cloudreve is a self-hosted file management and sharing system
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authentic…
CVE-2026-55502High· 7.1Cloudreve is a self-hosted file management and sharing system
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and app_id value…
CVE-2026-62323Medium· 6.3Cloudreve is a self-hosted file management and sharing system
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or comp…
GHSA-v6w6-358x-2433Medium· 5.4Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests
Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests
CVE-2026-54560High· 7.6Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim
Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim
CVE-2026-54562Medium· 6.5Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses
Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses
CVE-2026-25726High· 8.1Cloudreve is a self-hosted file management and sharing system
Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand seeded with time.Now().UnixNano() to generate critical security secrets, inclu…