Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-54563Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account root

High 7.1

In plain English

A high-severity incorrect authorization in cloudreve from cloudreve. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/cloudreve/Cloudreve	no fix listed	GO-2026-6298
Go	github.com/cloudreve/Cloudreve/v3	no fix listed	GHSA-w5fv-7x5q-g8qp
Go	github.com/cloudreve/Cloudreve/v3	no fix listed	GO-2026-6298
Go	github.com/cloudreve/Cloudreve/v4	4.0.0-20260606032813-26b6b1044b02	GHSA-w5fv-7x5q-g8qp
Go	github.com/cloudreve/Cloudreve/v4	4.0.0-20260606032813-26b6b1044b02	GO-2026-6298

Affected products (as reported)

Vendor	Product	Versions
cloudreve	cloudreve	< 4.16.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp x_refsource_CONFIRM