FR
live
High CVSS 7.1

CVE-2026-54563

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.

What this means

Exposure
Exploitable remotely over the network, with an ordinary user account and with no action from the victim.
Impact
An attacker can read sensitive data and alter some data.
Weakness
An authorisation check exists but its logic is wrong.
Likelihood
Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.

What to doFold into the next patch cycle.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published
15 July 2026
CVSS
7.1 (v3.1) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
EPSS
0.19% probability of exploitation within 30 days · above 9% of all CVEs
Weakness
CWE-863
Sources
nvd
References

Type at least two characters.

navigate open esc dismiss