MEDIUMCVSS 4.3

CVE-2026-55495

CVE-2026-55495 updated by NVD

Published: 2026-07-24
Modified: 2026-09-10
Sources: github-advisory, nvd

Summary

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite files elsewhere in the same owner account. This issue is fixed in version 4.17.0.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/cloudreve/Cloudreve/v3	—	—
Go	github.com/cloudreve/Cloudreve/v4	—	4.0.0-20260613023150-7968e50429ef

Remediation: No patched version is listed by GitHub.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-55495

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.