Executive brief
CloakBrowser, a tool used to bypass automated bot detection, contains a vulnerability that allows unauthorized users to delete files on the host system. By sending a specially crafted request to the service, an attacker can trick the software into deleting important folders outside of its intended storage area. This could lead to significant data loss or system instability, especially since the service is often accessible over the network by default.
Technical details
A path traversal vulnerability exists in the cloakserve CDP multiplexer component of CloakBrowser. The application fails to sanitize the 'fingerprint' query parameter, using it directly to construct filesystem paths for Chrome profile directories. An unauthenticated remote attacker can provide a crafted value containing traversal sequences (e.g., '../') to point the 'user_data_dir' to arbitrary locations on the disk. When the application attempts to clean up or fails to start a Chrome instance, it invokes 'shutil.rmtree()' on the resolved path, resulting in the deletion of the targeted directory. The risk is heightened by the fact that cloakserve binds to all interfaces (0.0.0.0) by default. This issue is fixed in version 0.3.28.
Affected products
- CloakHQ CloakBrowser < 0.3.28
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-01: disclosed: CVE published to NVD