github.com/cloudreve/Cloudreve vulnerabilities (Go)

16 vulnerabilities.

• github.com/cloudreve/Cloudreve Go Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope CVE-2026-77637 Fix available 3.8 LowSeptember 22, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service CVE-2026-77633 Fix available 7.1 HighSeptember 22, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses CVE-2026-79913 Fix available 6.5 MediumSeptember 22, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve before 4.16.1 Path Traversal via Remote Download CVE-2026-101051 2.3 LowAugust 24, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint CVE-2026-101056 6.9 MediumAugust 24, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope CVE-2026-101048 Fix available 5.3 MediumJuly 24, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored CVE-2026-62323 Fix available 6.3 MediumJuly 24, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials CVE-2026-55502 Fix available 7.1 HighJuly 24, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients CVE-2026-55499 Fix available 4.3 MediumJuly 24, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS) CVE-2026-55497 Fix available 6.5 MediumJuly 24, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate CVE-2026-55496 Fix available 4.3 MediumJuly 24, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account CVE-2026-55495 Fix available 4.3 MediumJuly 24, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim CVE-2026-54560 Fix available 7.6 HighJuly 15, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account root CVE-2026-54563 Fix available 7.1 HighJuly 15, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses CVE-2026-54562 Fix available 6.5 MediumJuly 15, 2026
• github.com/cloudreve/Cloudreve Go Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding) CVE-2026-25726 Fix available 8.1 HighMarch 31, 2026