Executive brief
Cloudreve is a self-hosted cloud storage system that supports remote file downloads via external downloaders like aria2. A vulnerability in how Cloudreve processes file paths from these remote downloaders allows attackers to cause downloaded files to be placed outside the intended folder structure using path traversal sequences like `../../`. An attacker with remote-download privileges could exploit this to write files to unintended locations in their accessible storage namespace, potentially overwriting files or bypassing organizational folder controls.
Technical details
The vulnerability exists in the remote download workflow (pkg/filemanager/workflows/remote_download.go) where Cloudreve combines a user-selected destination URI with a downloader-reported file name using the JoinRaw() function. The sanitizeFileName() function only replaces backslashes and special Windows characters (`:*?"<>|`) with underscores, but does not filter forward slashes or parent directory references (`..`). The JoinRaw() function then processes these unfiltered path segments, allowing `..` sequences to traverse up the directory tree. For aria2 downloads, the file name is extracted from the aria2 API response (aria2.tellStatus().files[].path), which is not validated before joining with the destination path. An authenticated user with remote-download permission can trigger this by creating a download task if the configured downloader returns a malicious path. The resulting file placement is subject to Cloudreve's existing upload and permission checks, limiting write scope to the user's accessible namespace.
Affected products
- Cloudreve Cloudreve <= 4.0.0-20260606032813-26b6b1044b02
Timeline
- 2026-06-13: disclosed: Published to GitHub Advisory Database
- 2026-08-24: advisory: GHSA-w8j7-39hp-8x59 published