CVE-2026-54563

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.16.1

Description Cloudreve is a self-hosted file management and sharing system. A flaw exists where a WebDAV account rooted at a configured folder can access files outside that directory by sending paths such as '/dav/%2e%2e/outside.txt'. This occurs because the stripPrefix function in pkg/webdav/webdav.go uses fs.URI.JoinRaw to join the decoded request suffix to the account root without verifying containment. Consequently, scoped credentials can read and list files outside the intended folder, and writable credentials can create, overwrite, move, or delete them.

Recommendations Update to version 4.16.1.