Executive brief
Cloudreve, a self-hosted file management and sharing system, contains a flaw in how it handles notifications for shared files. When a user is granted access to a single specific file, the system mistakenly subscribes them to activity updates for the entire folder containing that file. While an attacker cannot see the actual contents of other files, they can monitor the names, paths, and modification history of private files belonging to the owner that were never intended to be shared.
Technical details
The vulnerability exists in the Server-Sent Events (SSE) implementation within `service/explorer/events.go`. When a recipient accesses the event stream for a single-file share, the `share_navigator` resolves the root URI to the owner's parent folder rather than the specific shared file. The event hub then subscribes the user to the parent folder's ID. Because the publication logic only filters out the client ID that triggered the event and does not verify the subscriber's specific share scope, the recipient receives real-time metadata (names, paths, rename targets, and hashed identifiers) for all sibling files in that directory. This is fixed in version 4.17.0 by blocking subscriptions to single-file share roots.
Affected products
- Cloudreve Cloudreve < 4.17.0
Timeline
- 2026-06-26: patched: Version 4.17.0 released
- 2026-07-23: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: NVD publication date