https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 14:32:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338046 EUVD-2026-338046 https://cve.radiocsirt.org/vuln/euvd-2026-338046 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54563 <p>Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.</p> <p>Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54563 https://cve.radiocsirt.org/vuln/ghsa-w5fv-7x5q-g8qp <p><strong>Affected:</strong> Go: github.com/cloudreve/Cloudreve/v4, Go: github.com/cloudreve/Cloudreve/v3</p> <p>## Summary</p> <p>A Cloudreve WebDAV account stores a `uri` that defines the account&#39;s root folder. The WebDAV request handler (`stripPrefix` in `pkg/webdav/webdav.go`) trims the `/dav` prefix from the request path and joins the remainder to that root with `fs.URI.JoinRaw`, but never checks that the joined URI stays inside the root.</p> <p>Go&#39;s `net/http` decodes `%2e%2e` to `..` and `%2f` to `/` in `r.URL.Path` before the handler sees it, and `JoinRaw` resolves `..` segments through the standard library&#39;s `url.URL.JoinPath`. A request such as `GET /dav/%2e%2e/outside.txt` against a credential rooted at `cloudreve://my/restricted` therefore resolves to `cloudreve://my/outside.txt`. A scoped DAV credential can read and list files outside its configured folder; a writable scoped credential can also create, overwrite, move, and delete them.</p> <p>The escape stays inside the same Cloudreve user&#39;s namespace because downstream DBFS owner checks still apply. It does not cross into another user&#39;s files or onto the OS filesystem. What it breaks is the per-folder WebDAV-account boundary — the entire reason scoped DAV accounts exist (delegating limited access to a sync client or a third party).</p> <p>## Technical Detail</p> <p>### Root cause</p> <p>`stripPrefix` joins the request suffix onto the account base with no containment check:</p> <p>```go // pkg/webdav/webdav.go @ 54dc81d func stripPrefix(p string, u *ent.User) (string, *fs.URI, int, error) { base, err := fs.NewUriFromString(u.Edges.DavAccounts[0].URI) if err != n…</p> <p><strong>Affected:</strong> Go: github.com/cloudreve/Cloudreve/v4, Go: github.com/cloudreve/Cloudreve/v3</p> <p>## Summary</p> <p>A Cloudreve WebDAV account stores a `uri` that defines the account&#39;s root folder. The WebDAV request handler (`stripPrefix` in `pkg/webdav/webdav.go`) trims the `/dav` prefix from the request path and joins the remainder to that root with `fs.URI.JoinRaw`, but never checks that the joined URI stays inside the root.</p> <p>Go&#39;s `net/http` decodes `%2e%2e` to `..` and `%2f` to `/` in `r.URL.Path` before the handler sees it, and `JoinRaw` resolves `..` segments through the standard library&#39;s `url.URL.JoinPath`. A request such as `GET /dav/%2e%2e/outside.txt` against a credential rooted at `cloudreve://my/restricted` therefore resolves to `cloudreve://my/outside.txt`. A scoped DAV credential can read and list files outside its configured folder; a writable scoped credential can also create, overwrite, move, and delete them.</p> <p>The escape stays inside the same Cloudreve user&#39;s namespace because downstream DBFS owner checks still apply. It does not cross into another user&#39;s files or onto the OS filesystem. What it breaks is the per-folder WebDAV-account boundary — the entire reason scoped DAV accounts exist (delegating limited access to a sync client or a third party).</p> <p>## Technical Detail</p> <p>### Root cause</p> <p>`stripPrefix` joins the request suffix onto the account base with no containment check:</p> <p>```go // pkg/webdav/webdav.go @ 54dc81d func stripPrefix(p string, u *ent.User) (string, *fs.URI, int, error) { base, err := fs.NewUriFromString(u.Edges.DavAccounts[0].URI) if err != n…</p> https://cve.radiocsirt.org/vuln/ghsa-w5fv-7x5q-g8qp