GO-2026-6287 - Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint in github.com/clo

Severity: info · Published 2026-08-25

Technologies: github.com/cloudreve/Cloudreve/v4 (Go), github.com/cloudreve/Cloudreve/v3 (Go), github.com/cloudreve/Cloudreve (Go). Vendors: Go.

Executive brief

Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint in github.com/cloudreve/Cloudreve

Affected products

Go github.com/cloudreve/Cloudreve/v4
Go github.com/cloudreve/Cloudreve/v3
Go github.com/cloudreve/Cloudreve

Related threats

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a
GO-2026-6289 - Cloudreve's remote download file paths can escape the selected destination directory in github.com/cloudreve/Cloudreve
Cloudreve path traversal in remote download