CVE-2026-62323

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0

Description Cloudreve fails to properly validate WOPI access tokens and enforce requested viewer actions. The system generates tokens in the format <session-id>.<random-secret>, but the middleware.ViewerSessionValidation() function only validates the session-id prefix and ignores the random secret suffix. Consequently, any token with a valid session ID is accepted regardless of the suffix. Additionally, the system does not persist or enforce the preferred action requested during session creation. This allows a session created for view-only purposes to invoke write operations if the underlying file is writable by the user. This issue affects deployments using WOPI viewers for user files and can be exploited by a malicious or compromised WOPI viewer to modify files via the following endpoints:

Recommendations Update Cloudreve to version 4.17.0.