Cloudreve vulnerabilities
We track 5 vulnerabilities in Cloudreve products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.
Latest Cloudreve vulnerabilities
- 7.1 High severity
cloudreve: Concurrent Execution using Shared Resource with Improper Synchronization
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outsid
- 7.1 High severity
cloudreve: Incorrect Authorization
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and app_id values, allowing an OAuth to
- 7.1 High severity
cloudreve: Incorrect Authorization
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix
- 7.6 High severity
cloudreve: Incorrect Authorization
Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats
- 9.8 Critical severity
cloudreve: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand seeded with time.Now().UnixNano() to generate critical security secrets, including the secret_key, an