CVE-2026-55495: Cloudreve path traversal in WOPI PUT_RELATIVE handler

CVE-2026-55495 · Severity: medium · CVSS 4.3 · Published 2026-07-31

Cloudreve is a self-hosted file management and sharing system. A security flaw in its document editing integration allows a user with access to a single file to bypass security boundaries and create or overwrite other files within their own account. While this does not allow access to other users' data, it breaks the intended security restriction where a temporary access token should only be valid for one specific file.

Technologies: Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go), github.com/cloudreve/Cloudreve/v4 (Go). Vendors: Cloudreve, Go.

Quick answers

Is CVE-2026-55495 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55495 being exploited in the wild.
How severe is CVE-2026-55495?
Medium severity, with a CVSS score of 4.3, published 31 July 2026.
Which products and versions are affected?
Cloudreve < 4.17.0, <= 3.0.0-20250225100611-da4e44b77af4, < 4.0.0-20260613023150-7968e50429ef; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260613023150-7968e50429ef, SEMVER:introduced=0,fixed=4.0.0-20260613023150-7968e50429ef.
Is there a fix for CVE-2026-55495?
Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613023150-7968e50429ef or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55495 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55495?
Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613023150-7968e50429ef or later
    go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260613023150-7968e50429ef

Technical details

A path traversal vulnerability exists in Cloudreve's implementation of the Web Application Open Platform Interface (WOPI) protocol, specifically within the PUT_RELATIVE handler. The application processes the 'X-WOPI-SuggestedTarget' HTTP header using URI.JoinRaw, which internally utilizes Go's url.JoinPath to normalize path segments. Because the application fails to validate that the header contains only a filename, an attacker can provide a path containing directory traversal sequences (e.g., 'a/../../file.docx'). This allows a WOPI session token, which is cryptographically bound to a single file ID, to escape its intended scope and perform file operations elsewhere in the user's account. The vulnerability is rooted in the fact that the final validation check only inspects the 'cleaned' basename of the file rather than the fully resolved path. The issue is resolved in version 4.17.0 by ensuring the suggested target is treated strictly as a filename.

Affected products

  • Cloudreve Cloudreve < 4.17.0

Identifiers

  • CVE-2026-55495
  • GHSA-49h3-cwhj-4737
  • GO-2026-6097

Timeline

  • 2026-06-26: patched: Version 4.17.0 released
  • 2026-07-23: advisory: GitHub Security Advisory published
  • 2026-07-31: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.