Cloudreve vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 202616

Newest CVEs

• CVE-2026-101056

  Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint

  cloudreve · cloudreve

  Medium6.9
• CVE-2026-101051

  Cloudreve before 4.16.1 Path Traversal via Remote Download

  cloudreve · cloudreve

  Low2.3
• CVE-2026-101048

  Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

  cloudreve · cloudreve

  Medium5.3
• CVE-2026-77637

  Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

  cloudreve · cloudreve

  Low3.8
• CVE-2026-77633

  Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

  cloudreve · cloudreve

  High7.1
• CVE-2026-79913

  Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

  cloudreve · cloudreve

  Medium6.5
• CVE-2026-62323

  Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored

  cloudreve · cloudreve

  Medium6.3
• CVE-2026-55502

  Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials

  cloudreve · cloudreve

  High7.1
• CVE-2026-55499

  Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients

  cloudreve · cloudreve

  Medium4.3
• CVE-2026-55497

  Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)

  cloudreve · cloudreve

  Medium6.5