Vulnerability-Lookup

CVE-2026-77633 (GCVE-0-2026-77633)

Vulnerability from cvelistv5 – Published: 2026-09-22 15:28 – Updated: 2026-09-25 23:38

Title

Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

Summary

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-25 23:38 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/cloudreve/cloudreve/security/a…	x_refsource_CONFIRM
https://github.com/cloudreve/cloudreve/commit/732…	x_refsource_MISC
https://github.com/cloudreve/cloudreve/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
cloudreve	cloudreve	Affected: < 4.18.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77633",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T23:38:43.980886Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T23:38:53.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cloudreve",
          "vendor": "cloudreve",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.18.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T15:28:56.700Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj"
        },
        {
          "name": "https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df"
        },
        {
          "name": "https://github.com/cloudreve/cloudreve/releases/tag/4.18.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xj3h-wwxq-gfcj",
        "discovery": "UNKNOWN"
      },
      "title": "Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77633",
    "datePublished": "2026-09-22T15:28:56.700Z",
    "dateReserved": "2026-08-20T20:52:01.927Z",
    "dateUpdated": "2026-09-25T23:38:53.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77633",
      "date": "2026-10-02",
      "epss": "0.00368",
      "percentile": "0.28393"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "cloudreve",
                "vendor": "cloudreve",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.18.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0."
          }
        ],
        "id": "CVE-2026-77633",
        "lastModified": "2026-09-26T00:16:35.823",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-77633",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T23:38:43.980886Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-22T16:17:55.817",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              },
              {
                "lang": "en",
                "value": "CWE-367"
              },
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-77633",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-25T23:38:43.980886Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-25T23:38:49.174Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "cloudreve",
              "vendor": "cloudreve",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.18.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-362",
                  "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-367",
                  "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-22T15:28:56.700Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj"
            },
            {
              "name": "https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df"
            },
            {
              "name": "https://github.com/cloudreve/cloudreve/releases/tag/4.18.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"
            }
          ],
          "source": {
            "advisory": "GHSA-xj3h-wwxq-gfcj",
            "discovery": "UNKNOWN"
          },
          "title": "Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-77633",
        "datePublished": "2026-09-22T15:28:56.700Z",
        "dateReserved": "2026-08-20T20:52:01.927Z",
        "dateUpdated": "2026-09-25T23:38:53.232Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-377176

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:40

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:40:25.245905+00:00",
  "id": "EUVD-2026-377176"
}

FKIE_CVE-2026-77633

Vulnerability from fkie_nvd - Published: 2026-09-22 16:17 - Updated: 2026-09-26 00:16

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df
	security-advisories@github.com	https://github.com/cloudreve/cloudreve/releases/tag/4.18.0
	security-advisories@github.com	https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "cloudreve",
          "vendor": "cloudreve",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.18.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0."
    }
  ],
  "id": "CVE-2026-77633",
  "lastModified": "2026-09-26T00:16:35.823",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77633",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-25T23:38:43.980886Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-22T16:17:55.817",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        },
        {
          "lang": "en",
          "value": "CWE-367"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XJ3H-WWXQ-GFCJ

Vulnerability from github – Published: 2026-09-22 20:40 – Updated: 2026-09-22 20:40

Summary

Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

Details

Summary

Cloudreve v4 splits the storage-quota check (reading the user's used bytes and comparing them to MaxStorage) and the charge (incrementing users.storage) into two non-atomic steps in the PrepareUpload code path. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition. Any authenticated user — including an unprivileged account in the default User group — can concurrently issue several upload-session requests that all read the same stale used snapshot, each pass the check, and then each contribute their declared size to users.storage. The end result is that the total approved capacity exceeds the group's MaxStorage many times over.

The same primitive is trivially amplifiable into a storage-based denial of service. During PrepareUpload, Cloudreve reserves the declared size against users.storage before any bytes are written, so an attacker can push the reserved amount far beyond the host's physical disk (tested: a 1 GiB-quota account reserved 17 GiB in a single 20-way burst), and can then materialise the reservation by completing chunked uploads to actually write the excess bytes to disk. Amplification to the host's free space fills the disk and denies uploads for every user of the instance.

Exploitation requires only a valid session with Files.Write permission. No administrator configuration, no non-default storage policy, and no elevated privileges are needed. The default deployment (local storage policy, default User group) is affected.

Technical details

PrepareUpload in pkg/filemanager/fs/dbfs/upload.go splits quota enforcement across two stages:

Stage A — the check (snapshot compare, no lock) — pkg/filemanager/fs/dbfs/validator.go:

func (f *DBFS) validateUserCapacity(ctx context.Context, size int64, u *ent.User) error {
    capacity, err := f.Capacity(ctx, u)              // reads "used"
    if err != nil { return ... }
    return f.validateUserCapacityRaw(ctx, size, capacity)
}

func (f *DBFS) validateUserCapacityRaw(ctx context.Context, size int64, capacity *fs.Capacity) error {
    if capacity.Used + size > capacity.Total {       // snapshot compare only; no lock, no reservation
        return fs.ErrInsufficientCapacity
    }
    return nil
}

capacity.Used comes from the in-memory *ent.User that was hydrated once at the beginning of the request — pkg/filemanager/fs/dbfs/dbfs.go:

func (f *DBFS) Capacity(ctx context.Context, u *ent.User) (*fs.Capacity, error) {
    ...
    res.Used  = f.user.Storage            // captured at request start
    res.Total = requesterGroup.MaxStorage
    return res, nil
}

No SELECT is issued at check time, no row lock is taken on the user row, and pending upload sessions are not counted.

Stage B — the charge (single unconditional UPDATE, outside the tx) — pkg/filemanager/fs/dbfs/upload.go → inventory/tx.go → inventory/user.go:

// PrepareUpload: check (A) ...  then, many statements later ...
if err := f.validateUserCapacity(ctx, req.Props.Size, ancestor.Owner()); err != nil {
    return nil, err
}
...
if err := inventory.CommitWithStorageDiff(ctx, dbTx, f.l, f.userClient); err != nil { ... }  // charge (B)

// inventory/user.go
c.client.User.Update().Where(user.ID(uid)).AddStorage(diff).Exec(ctx)  // SQL: storage = storage + diff

Between A and B the code performs storage-policy load-balancing, save-path generation, encryption-metadata generation, transaction start, placeholder-file/entity creation, and metadata upsert. This leaves a wide race window. N concurrent PrepareUpload requests each read the same stale Used snapshot at A, each pass their independent quota check, and then each add their own size to users.storage at B. The committed total is up to N × size above MaxStorage.

Three defensive controls that would each independently close the race are missing:

The check and the charge are not enclosed in the same transaction with a SELECT ... FOR UPDATE on the user row.
The charge is a plain storage = storage + :size UPDATE, not an atomic conditional update of the form UPDATE users SET storage = storage + :size WHERE id = :uid AND storage + :size <= :max_storage.
Used is computed only from committed entities. Concurrent pending upload sessions (which have already been reserved by the accounting model) are not counted, so races among sessions that haven't yet completed are invisible to each other.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cloudreve/Cloudreve/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.0-20260715025621-7329602751c0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362",
      "CWE-367",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:40:33Z",
    "nvd_published_at": "2026-09-22T16:17:55Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nCloudreve v4 splits the storage-quota **check** (reading the user\u0027s `used` bytes and comparing them to `MaxStorage`) and the **charge** (incrementing `users.storage`) into two non-atomic steps in the `PrepareUpload` code path. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition. Any authenticated user \u2014 including an unprivileged account in the default `User` group \u2014 can concurrently issue several upload-session requests that all read the same stale `used` snapshot, each pass the check, and then each contribute their declared `size` to `users.storage`. The end result is that the total approved capacity exceeds the group\u0027s `MaxStorage` many times over.\n\nThe same primitive is trivially amplifiable into a storage-based denial of service. During `PrepareUpload`, Cloudreve reserves the declared size against `users.storage` before any bytes are written, so an attacker can push the reserved amount far beyond the host\u0027s physical disk (tested: a 1 GiB-quota account reserved 17 GiB in a single 20-way burst), and can then materialise the reservation by completing chunked uploads to actually write the excess bytes to disk. Amplification to the host\u0027s free space fills the disk and denies uploads for every user of the instance.\n\nExploitation requires only a valid session with `Files.Write` permission. No administrator configuration, no non-default storage policy, and no elevated privileges are needed. The default deployment (local storage policy, default `User` group) is affected.\n\n## Technical details\n\n`PrepareUpload` in `pkg/filemanager/fs/dbfs/upload.go` splits quota enforcement across two stages:\n\n**Stage A \u2014 the check (snapshot compare, no lock)** \u2014 `pkg/filemanager/fs/dbfs/validator.go`:\n\n```go\nfunc (f *DBFS) validateUserCapacity(ctx context.Context, size int64, u *ent.User) error {\n    capacity, err := f.Capacity(ctx, u)              // reads \"used\"\n    if err != nil { return ... }\n    return f.validateUserCapacityRaw(ctx, size, capacity)\n}\n\nfunc (f *DBFS) validateUserCapacityRaw(ctx context.Context, size int64, capacity *fs.Capacity) error {\n    if capacity.Used + size \u003e capacity.Total {       // snapshot compare only; no lock, no reservation\n        return fs.ErrInsufficientCapacity\n    }\n    return nil\n}\n```\n\n`capacity.Used` comes from the in-memory `*ent.User` that was hydrated once at the beginning of the request \u2014 `pkg/filemanager/fs/dbfs/dbfs.go`:\n\n```go\nfunc (f *DBFS) Capacity(ctx context.Context, u *ent.User) (*fs.Capacity, error) {\n    ...\n    res.Used  = f.user.Storage            // captured at request start\n    res.Total = requesterGroup.MaxStorage\n    return res, nil\n}\n```\n\nNo SELECT is issued at check time, no row lock is taken on the user row, and pending upload sessions are not counted.\n\n**Stage B \u2014 the charge (single unconditional UPDATE, outside the tx)** \u2014 `pkg/filemanager/fs/dbfs/upload.go` \u2192 `inventory/tx.go` \u2192 `inventory/user.go`:\n\n```go\n// PrepareUpload: check (A) ...  then, many statements later ...\nif err := f.validateUserCapacity(ctx, req.Props.Size, ancestor.Owner()); err != nil {\n    return nil, err\n}\n...\nif err := inventory.CommitWithStorageDiff(ctx, dbTx, f.l, f.userClient); err != nil { ... }  // charge (B)\n\n// inventory/user.go\nc.client.User.Update().Where(user.ID(uid)).AddStorage(diff).Exec(ctx)  // SQL: storage = storage + diff\n```\n\nBetween A and B the code performs storage-policy load-balancing, save-path generation, encryption-metadata generation, transaction start, placeholder-file/entity creation, and metadata upsert. This leaves a wide race window. `N` concurrent `PrepareUpload` requests each read the same stale `Used` snapshot at A, each pass their independent quota check, and then each add their own `size` to `users.storage` at B. The committed total is up to `N \u00d7 size` above `MaxStorage`.\n\nThree defensive controls that would each independently close the race are missing:\n\n1. The check and the charge are not enclosed in the same transaction with a `SELECT ... FOR UPDATE` on the user row.\n2. The charge is a plain `storage = storage + :size` UPDATE, not an atomic conditional update of the form `UPDATE users SET storage = storage + :size WHERE id = :uid AND storage + :size \u003c= :max_storage`.\n3. `Used` is computed only from committed entities. Concurrent pending upload sessions (which have already been reserved by the accounting model) are not counted, so races among sessions that haven\u0027t yet completed are invisible to each other.",
  "id": "GHSA-xj3h-wwxq-gfcj",
  "modified": "2026-09-22T20:40:33Z",
  "published": "2026-09-22T20:40:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77633"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cloudreve/cloudreve"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-77633 (GCVE-0-2026-77633)

EUVD-2026-377176

FKIE_CVE-2026-77633

GHSA-XJ3H-WWXQ-GFCJ

Summary

Technical details

Tags

Sightings

Nomenclature

Related by attack behaviour