Executive brief
Cloudreve is a self-hosted file management and sharing platform. A former file-share recipient can generate signed download URLs for files they previously had access to for up to 5 minutes after the share is deleted or expires, bypassing the owner's revocation decision and download limits. An attacker must have already seen the files during a valid share and obtained the share hint.
Technical details
The vulnerability is a broken access control (CWE-863) in the share-caching mechanism. The root cause spans multiple components: (1) file-listing responses return a `context_hint` (UUID) and file paths to the client; (2) the `file/url` and `file/thumb` routes accept this hint via the `X-Cr-Context-Hint` header without independent share re-validation; (3) DBFS caches `shareNavigatorState` (containing `shareRoot` and `share` row) for 300 seconds under the hint; (4) on cache hit, `shareNavigator.RestoreState` restores cached state, and `shareNavigator.To` skips calling `Root()`, which is the sole place that re-checks `inventory.IsValidShare` (expiry, download limits, owner status, source-file validity) and password; (5) failed download hooks are only logged and do not block URL generation; (6) signed content endpoints validate only the signature, not share state. An attacker who is a former recipient must pre-warm the hint cache while a share is valid, then after the owner deletes the share or it expires, can replay the cached hint within 300 seconds to obtain signed download URLs without re-authorization. Exploitation requires prior knowledge of the target file URI from a valid share listing.
Affected products
- cloudreve Cloudreve <= 4.0.0-20260606032813-26b6b1044b02
Timeline
- 2026-08-24: disclosed