CVE-2026-55499

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0

Description An authenticated recipient of a single-file share can access file-activity metadata for other files and folders located in the owner's parent folder that were not intended to be shared. This occurs because the system resolves the share root to the owner's parent folder and subscribes the user to that folder's topic, failing to restrict the event stream to the specific shared file. Consequently, the recipient can receive real-time Server-Sent Events containing names, paths, rename targets, event types, and hashed identifiers for sibling files and folders.

Technical details include:

Recommendations Update to version 4.17.0. As a temporary mitigation, restrict access to the GET /api/v4/file/events endpoint for users with single-file share permissions.