https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 20:00:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343470 EUVD-2026-343470 https://cve.radiocsirt.org/vuln/euvd-2026-343470 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55495 <p>Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite files elsewhere in the same owner account. This issue is fixed in version 4.17.0.</p> <p>Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite files elsewhere in the same owner account. This issue is fixed in version 4.17.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55495 https://cve.radiocsirt.org/vuln/ghsa-49h3-cwhj-4737 <p><strong>Affected:</strong> Go: github.com/cloudreve/Cloudreve/v4, Go: github.com/cloudreve/Cloudreve/v3</p> <p>## Summary Cloudreve&#39;s WOPI `PUT_RELATIVE` handler treats `X-WOPI-SuggestedTarget` as a path, not a filename. It splits the header on `/` and joins the segments onto the source file&#39;s directory with `URI.JoinRaw`, which feeds Go&#39;s `url.JoinPath`. `url.JoinPath` resolves `.`/`..` segments, so a slash-bearing target such as `a/../../evil.docx` collapses to a location outside the source file&#39;s directory. The lower-level upload path then validates only the final, already-cleaned basename (`evil.docx`), which is harmless, and checks ownership against the *resolved ancestor* — which is still the same user&#39;s drive. A WOPI access token is bound to exactly one file (the route enforces `fileId == session.FileID` with a 403 otherwise). `PUT_RELATIVE` escapes that per-file scope: a token issued for one file can create (and, conditionally, overwrite) files elsewhere in the same account.</p> <p>## Root cause (verified at `26b6b10`) **1. Token is single-file scoped (the boundary being escaped)** — `middleware` `ViewerSessionValidation`: ```go fileId := hashid.FromContext(c) if fileId != session.FileID { // 403 — token is bound to ONE file c.Status(http.StatusForbidden); c.Abort(); return } ``` Route: `wopi := noAuth.Group(&#34;file/wopi&#34;, middleware.HashID(hashid.FileID), middleware.ViewerSessionValidation())`; `wopi.POST(&#34;:id&#34;, controllers.ModifyFile)` → `POST /api/v4/file/wopi/:id?access_token=&lt;token&gt;`. **2. `PUT_RELATIVE` dispatch** — `routers/controllers/wopi.go`: ```…</p> <p><strong>Affected:</strong> Go: github.com/cloudreve/Cloudreve/v4, Go: github.com/cloudreve/Cloudreve/v3</p> <p>## Summary Cloudreve&#39;s WOPI `PUT_RELATIVE` handler treats `X-WOPI-SuggestedTarget` as a path, not a filename. It splits the header on `/` and joins the segments onto the source file&#39;s directory with `URI.JoinRaw`, which feeds Go&#39;s `url.JoinPath`. `url.JoinPath` resolves `.`/`..` segments, so a slash-bearing target such as `a/../../evil.docx` collapses to a location outside the source file&#39;s directory. The lower-level upload path then validates only the final, already-cleaned basename (`evil.docx`), which is harmless, and checks ownership against the *resolved ancestor* — which is still the same user&#39;s drive. A WOPI access token is bound to exactly one file (the route enforces `fileId == session.FileID` with a 403 otherwise). `PUT_RELATIVE` escapes that per-file scope: a token issued for one file can create (and, conditionally, overwrite) files elsewhere in the same account.</p> <p>## Root cause (verified at `26b6b10`) **1. Token is single-file scoped (the boundary being escaped)** — `middleware` `ViewerSessionValidation`: ```go fileId := hashid.FromContext(c) if fileId != session.FileID { // 403 — token is bound to ONE file c.Status(http.StatusForbidden); c.Abort(); return } ``` Route: `wopi := noAuth.Group(&#34;file/wopi&#34;, middleware.HashID(hashid.FileID), middleware.ViewerSessionValidation())`; `wopi.POST(&#34;:id&#34;, controllers.ModifyFile)` → `POST /api/v4/file/wopi/:id?access_token=&lt;token&gt;`. **2. `PUT_RELATIVE` dispatch** — `routers/controllers/wopi.go`: ```…</p> https://cve.radiocsirt.org/vuln/ghsa-49h3-cwhj-4737