Executive brief
Cross site scripting in Cloudreve
Affected products
- Go github.com/HFO4/cloudreve
- Go github.com/cloudreve/Cloudreve/v3
Junglewise Threat Intelligence
CVE-2022-32167: Cross site scripting in Cloudreve
CVE-2022-32167 · Severity: low · CVSS 3.1 · Published 2022-09-21
Technologies: github.com/cloudreve/Cloudreve/v3 (Go). Vendors: Go.
Related threats
- GO-2026-6289 - Cloudreve's remote download file paths can escape the selected destination directory in github.com/cloudreve/Cloudreve
- GO-2026-6287 - Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint in github.com/clo
- GO-2026-6106 - Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve
- Cloudreve incorrect authorization in WOPI session validation
- Cloudreve incorrect authorization in OneDrive storage policy configuration