# CVE-2026-55495: Cloudreve path traversal in WOPI PUT_RELATIVE handler

Source: https://junglewise.ai/threats/cve-2026-55495-cloudreve-path-traversal-in-wopi-put-relative-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-55495 · Severity: medium · CVSS 4.3 · Published 2026-07-31

Cloudreve is a self-hosted file management and sharing system. A security flaw in its document editing integration allows a user with access to a single file to bypass security boundaries and create or overwrite other files within their own account. While this does not allow access to other users' data, it breaks the intended security restriction where a temporary access token should only be valid for one specific file.

Technologies: [Cloudreve](https://junglewise.ai/threats/technologies/cloudreve), [github.com/cloudreve/Cloudreve (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve), [github.com/cloudreve/Cloudreve/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v3), [github.com/cloudreve/Cloudreve/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v4). Vendors: [Cloudreve](https://junglewise.ai/threats/vendors/cloudreve), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55495 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55495 being exploited in the wild.

**How severe is CVE-2026-55495?** Medium severity, with a CVSS score of 4.3, published 31 July 2026.

**Which products and versions are affected?** Cloudreve < 4.17.0, <= 3.0.0-20250225100611-da4e44b77af4, < 4.0.0-20260613023150-7968e50429ef; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260613023150-7968e50429ef, SEMVER:introduced=0,fixed=4.0.0-20260613023150-7968e50429ef.

**Is there a fix for CVE-2026-55495?** Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613023150-7968e50429ef or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55495 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55495?** Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613023150-7968e50429ef or later

  ```sh
  go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260613023150-7968e50429ef
  ```


## Technical details

A path traversal vulnerability exists in Cloudreve's implementation of the Web Application Open Platform Interface (WOPI) protocol, specifically within the PUT_RELATIVE handler. The application processes the 'X-WOPI-SuggestedTarget' HTTP header using URI.JoinRaw, which internally utilizes Go's url.JoinPath to normalize path segments. Because the application fails to validate that the header contains only a filename, an attacker can provide a path containing directory traversal sequences (e.g., 'a/../../file.docx'). This allows a WOPI session token, which is cryptographically bound to a single file ID, to escape its intended scope and perform file operations elsewhere in the user's account. The vulnerability is rooted in the fact that the final validation check only inspects the 'cleaned' basename of the file rather than the fully resolved path. The issue is resolved in version 4.17.0 by ensuring the suggested target is treated strictly as a filename.

## Affected products

- Cloudreve Cloudreve < 4.17.0

## Identifiers

- CVE-2026-55495
- GHSA-49h3-cwhj-4737
- GO-2026-6097

## Timeline

- 2026-06-26: patched: Version 4.17.0 released
- 2026-07-23: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD

## References

- [https://github.com/cloudreve/cloudreve/commit/7968e50429efab40ffa8f57fecdfbd5a73d23630](https://github.com/cloudreve/cloudreve/commit/7968e50429efab40ffa8f57fecdfbd5a73d23630)
- [https://github.com/cloudreve/cloudreve/releases/tag/4.17.0](https://github.com/cloudreve/cloudreve/releases/tag/4.17.0)
- [https://github.com/cloudreve/cloudreve/security/advisories/GHSA-49h3-cwhj-4737](https://github.com/cloudreve/cloudreve/security/advisories/GHSA-49h3-cwhj-4737)

## Related threats

- [Cloudreve access control bypass in share validation](https://junglewise.ai/threats/cve-2026-101056-cloudreve-before-4-16-1-fails-to-revalidate-share-access-when)
- [Cloudreve authorization bypass in admin node test endpoints](https://junglewise.ai/threats/cve-2026-101048-cloudreve-before-4-17-0-registers-the-administrative-node-test)
- [Cloudreve SSRF guard bypass via IPv6 transition wrappers](https://junglewise.ai/threats/cve-2026-79913-cloudreve-ssrf-guard-bypass-via-ipv6-transition-wrappers)
- [Cloudreve privilege scope bypass in admin API endpoints](https://junglewise.ai/threats/cve-2026-77637-cloudreve-privilege-scope-bypass-in-admin-api-endpoints)
- [Cloudreve TOCTOU race in storage-quota check and charge](https://junglewise.ai/threats/cve-2026-77633-cloudreve-toctou-race-in-storage-quota-check-and-charge)