Executive brief
Cloudreve is a self-hosted file management and sharing system. A security flaw in its document editing integration allows a user with access to a single file to bypass security boundaries and create or overwrite other files within their own account. While this does not allow access to other users' data, it breaks the intended security restriction where a temporary access token should only be valid for one specific file.
Technical details
A path traversal vulnerability exists in Cloudreve's implementation of the Web Application Open Platform Interface (WOPI) protocol, specifically within the PUT_RELATIVE handler. The application processes the 'X-WOPI-SuggestedTarget' HTTP header using URI.JoinRaw, which internally utilizes Go's url.JoinPath to normalize path segments. Because the application fails to validate that the header contains only a filename, an attacker can provide a path containing directory traversal sequences (e.g., 'a/../../file.docx'). This allows a WOPI session token, which is cryptographically bound to a single file ID, to escape its intended scope and perform file operations elsewhere in the user's account. The vulnerability is rooted in the fact that the final validation check only inspects the 'cleaned' basename of the file rather than the fully resolved path. The issue is resolved in version 4.17.0 by ensuring the suggested target is treated strictly as a filename.
Affected products
- Cloudreve Cloudreve < 4.17.0
Timeline
- 2026-06-26: patched: Version 4.17.0 released
- 2026-07-23: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD