CVE-2026-54563
High
Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.
SeverityHigh
CVSS7.1
Exploit probability—
ProductGithub.com/cloudreve/cloudreve/v4
PublishedJul 15, 2026
First seenJul 15, 2026
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- github.com/cloudreve/Cloudreve/v44.0.0-20260606032813-26b6b1044b02 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/cloudreve/Cloudreve/v4Go | v < 4.0.0-20260606032813-26b6b1044b02 | 4.0.0-20260606032813-26b6b1044b02 |
| github.com/cloudreve/Cloudreve/v3Go | v ≤ 3.0.0-20250225100611-da4e44b77af4, No range specified | — |
| github.com/cloudreve/CloudreveGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.