Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5.5, published 24 August 2026.

Which products and versions are affected?

github.com/cloudreve/Cloudreve/v4 (Go) <= 4.0.0-20260606032813-26b6b1044b02.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run github.com/cloudreve/Cloudreve/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Cloudreve path traversal in remote download

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run github.com/cloudreve/Cloudreve/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 5.5 · Published 2026-08-24

Cloudreve is a self-hosted cloud storage system that supports remote file downloads via external downloaders like aria2. A vulnerability in how Cloudreve processes file paths from these remote downloaders allows attackers to cause downloaded files to be placed outside the intended folder structure using path traversal sequences like `../../`. An attacker with remote-download privileges could exploit this to write files to unintended locations in their accessible storage namespace, potentially overwriting files or bypassing organizational folder controls.

Technologies: github.com/cloudreve/Cloudreve/v4 (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5.5, published 24 August 2026.
Which products and versions are affected?: github.com/cloudreve/Cloudreve/v4 (Go) <= 4.0.0-20260606032813-26b6b1044b02.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run github.com/cloudreve/Cloudreve/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the remote download workflow (pkg/filemanager/workflows/remote_download.go) where Cloudreve combines a user-selected destination URI with a downloader-reported file name using the JoinRaw() function. The sanitizeFileName() function only replaces backslashes and special Windows characters (`:*?"<>|`) with underscores, but does not filter forward slashes or parent directory references (`..`). The JoinRaw() function then processes these unfiltered path segments, allowing `..` sequences to traverse up the directory tree. For aria2 downloads, the file name is extracted from the aria2 API response (aria2.tellStatus().files[].path), which is not validated before joining with the destination path. An authenticated user with remote-download permission can trigger this by creating a download task if the configured downloader returns a malicious path. The resulting file placement is subject to Cloudreve's existing upload and permission checks, limiting write scope to the user's accessible namespace.

Affected products

Cloudreve Cloudreve <= 4.0.0-20260606032813-26b6b1044b02

Timeline

2026-06-13: disclosed: Published to GitHub Advisory Database
2026-08-24: advisory: GHSA-w8j7-39hp-8x59 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.