Jinhao-Huang

**Name of the Vulnerable Software and Affected Versions** Cloudreve versions prior to 4.16.1 **Description** Authenticated users can create files outside the intended destination directory because the software fails to properly sanitize file paths returned by remote downloaders. This issue allows the use of path traversal sequences—a technique used to access files and directories that are stored outside the web root folder—within downloader metadata to write files to unexpected locations within accessible namespaces. **Recommendations** Update to version 4.16.1 or later.