CVE-2026-55495

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0

Description The WOPI PUT RELATIVE handler incorrectly processes the X-WOPI-SuggestedTarget variable by passing it to URI.JoinRaw() as a path instead of a filename. This allows the use of slash and dot-dot segments to perform path traversal, enabling an attacker to escape the source file directory to create or conditionally overwrite files within the same owner account.

Recommendations Update to version 4.17.0.