CVE-2026-101051, CoreCVE

Back Back to CVE browser

LOW

Cloudreve before 4.16.1 Path Traversal via Remote Download

Published Sep 27, 2026

2.3

LOW

CVSS 4.0

EPSS 0.22%

Description

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations within accessible namespaces.

Affected products

Vendor Cloudreve Product Cloudreve Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <4.16.1
- Version
  4.16.1
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cloudreve

unaffected

Version	Status	Constraints
0	affected	<4.16.1
4.16.1	unaffected	-

github.com/cloudreve/Cloudreve/v4

Go

Introduced 0 Fixed not fixed
github.com/cloudreve/Cloudreve

Go

Introduced 0 Fixed not fixed
github.com/cloudreve/Cloudreve/v3

Go

Introduced 0 Fixed not fixed

Ecosystem	Package	Fixed
Go	github.com/cloudreve/Cloudreve/v4	not fixed
Go	github.com/cloudreve/Cloudreve	not fixed
Go	github.com/cloudreve/Cloudreve/v3	not fixed

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8j7-39hp-8x59
exploitvendor-advisory
https://www.vulncheck.com/advisories/cloudreve-before-4.16.1-path-traversal-via-remote-download
third-party-advisory

Link	Providers	Tags
https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8j7-39hp-8x59		exploitvendor-advisory
https://www.vulncheck.com/advisories/cloudreve-before-4.16.1-path-traversal-via-remote-download		third-party-advisory