CVE-2026-77633: Cloudreve TOCTOU race in storage-quota check and charge

CVE-2026-77633 · Severity: high · CVSS 7.1 · Published 2026-09-22

Cloudreve is a self-hosted file-sharing and storage application. A race condition in the upload process allows authenticated users to bypass storage quotas and exhaust disk space, denying service to all other users. Any user account can trigger this flaw; no special privileges or configuration changes are required.

Technologies: Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go), github.com/cloudreve/Cloudreve/v4 (Go). Vendors: Cloudreve, Go.

Quick answers

Is CVE-2026-77633 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77633 being exploited in the wild.
How severe is CVE-2026-77633?
High severity, with a CVSS score of 7.1, published 22 September 2026.
Which products and versions are affected?
Cloudreve v4; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260715025621-7329602751c0, SEMVER:introduced=0,fixed=4.0.0-20260715025621-7329602751c0.
Is there a fix for CVE-2026-77633?
Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260715025621-7329602751c0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77633 attacked?
It is attacked over the network.
Am I affected by CVE-2026-77633?
Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260715025621-7329602751c0 or later
    go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260715025621-7329602751c0

Technical details

The vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition in the PrepareUpload code path. The storage-quota check reads the user's current storage consumption and compares it against MaxStorage (Stage A), but this check and the subsequent charge operation (Stage B, which increments users.storage) are not atomic and lack row-level locking. Between these stages, concurrent requests can each read the same stale storage snapshot, all pass the quota check independently, and then all commit their size increments—resulting in total usage far exceeding the quota. An attacker with valid user credentials and Files.Write permission can exploit this by issuing concurrent upload requests; this is amplifiable into a denial-of-service by reserving space beyond the host's physical disk and materializing it through chunked uploads. The default deployment is vulnerable.

Affected products

  • Cloudreve Cloudreve v4

Identifiers

  • CVE-2026-77633
  • GHSA-xj3h-wwxq-gfcj
  • GO-2026-6578

Timeline

  • 2026-09-22: disclosed
  • other: CVE-2026-77633 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.