CVE-2026-101051

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.16.1

Description Authenticated users can create files outside the intended destination directory because the software fails to properly sanitize file paths returned by remote downloaders. This issue allows the use of path traversal sequences—a technique used to access files and directories that are stored outside the web root folder—within downloader metadata to write files to unexpected locations within accessible namespaces.

Recommendations Update to version 4.16.1 or later.