Executive brief
Cloudreve is a self-hosted file-sharing and storage application. A race condition in the upload process allows authenticated users to bypass storage quotas and exhaust disk space, denying service to all other users. Any user account can trigger this flaw; no special privileges or configuration changes are required.
Technical details
The vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition in the PrepareUpload code path. The storage-quota check reads the user's current storage consumption and compares it against MaxStorage (Stage A), but this check and the subsequent charge operation (Stage B, which increments users.storage) are not atomic and lack row-level locking. Between these stages, concurrent requests can each read the same stale storage snapshot, all pass the quota check independently, and then all commit their size increments—resulting in total usage far exceeding the quota. An attacker with valid user credentials and Files.Write permission can exploit this by issuing concurrent upload requests; this is amplifiable into a denial-of-service by reserving space beyond the host's physical disk and materializing it through chunked uploads. The default deployment is vulnerable.
Affected products
- Cloudreve Cloudreve v4
Timeline
- 2026-09-22: disclosed
- other: CVE-2026-77633 assigned