MEDIUMCVSS 4.3

CVE-2026-55499

CVE-2026-55499 updated by NVD

Published: 2026-07-24
Modified: 2026-09-10
Sources: github-advisory, nvd

Summary

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/cloudreve/Cloudreve/v3	—	—
Go	github.com/cloudreve/Cloudreve/v4	—	4.0.0-20260613030215-0b00dd308f13

Remediation: No patched version is listed by GitHub.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-55499

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.