Log in Start free

Cloudreve

Products

ProductCVEsExploitedLatest
Cloudreve17–Sep 27, 2026

Exploited and recent CVEs

  • CVE-2026-101056 Medium 5.3 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint 0.2%
  • CVE-2026-101051 Low 3.1 Cloudreve before 4.16.1 Path Traversal via Remote Download 0.3%
  • CVE-2026-101048 Medium 5.4 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope 0.2%
  • CVE-2026-77637 Low 3.8 Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope 0.3%
  • CVE-2026-77633 High 7.1 Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service 0.4%
  • CVE-2026-79913 Medium 6.5 Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses 0.4%
  • CVE-2026-62323 Medium 6.3 Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored 0.3%
  • CVE-2026-55502 High 7.1 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials 0.3%
  • CVE-2026-55499 Medium 4.3 Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients 0.3%
  • CVE-2026-55497 Medium 6.5 Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS) 0.5%
  • CVE-2026-55496 Medium 4.3 Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate 0.4%
  • CVE-2026-55495 Medium 4.3 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account 0.4%
  • CVE-2026-54560 High 7.6 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim 0.6%
  • CVE-2026-54563 High 7.1 Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account root 0.3%
  • CVE-2026-54562 Medium 6.5 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses 0.4%
  • CVE-2026-25726 High 8.1 Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding) 0.4%
  • CVE-2022-32167 Medium 5.4 Cloudreve - Stored XSS 0.6%