CVE-2026-54563
Deferred Deferred - Pending Action

Path Traversal in Cloudreve File Management System

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-08-04
AI Q&A
2026-07-15
EPSS Evaluated
2026-08-03
NVD
CVE-2026-54563
EUVD
EUVD-2026-44688

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cloudreve cloudreve to 4.16.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54563 is a Path Traversal and Broken Access Control vulnerability in Cloudreve's WebDAV feature. It allows a user with a restricted WebDAV account to access files outside their designated folder by exploiting URL-encoded path segments like %2e%2e (which decodes to ..). The system fails to properly validate the final path, letting attackers read, list, or modify files beyond their intended scope.

Detection Guidance

To detect this vulnerability, check if your Cloudreve instance is running a version prior to 4.16.1. Use commands like 'curl -s https://your-cloudreve-domain.com/version' or inspect the admin panel for version details. Test for path traversal by sending WebDAV requests with encoded paths like /dav/%2e%2e/outside.txt to see if files outside the configured folder are accessible.

Impact Analysis

If you use Cloudreve with WebDAV enabled, an attacker with a valid but restricted WebDAV account could access sensitive files outside their folder. They could read confidential data, overwrite or delete files, or even move files within your Cloudreve instance. This bypasses the intended access restrictions of scoped accounts.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding health information. It undermines access controls meant to protect regulated data, potentially resulting in compliance breaches and legal consequences.

Mitigation Strategies

Immediately upgrade Cloudreve to version 4.16.1 or later to patch the vulnerability. If upgrading is not possible, disable WebDAV functionality or restrict access to trusted users until the update is applied. Monitor logs for suspicious WebDAV requests containing encoded paths like %2e%2e or %2f.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54563. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart