{"items":[{"id":"NVI-00014197","kind":"vulnerability","title":"Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-w5fv-7x5q-g8qp","CVE-2026-54563"],"plain_summary":"GitHub lists this reviewed advisory for github.com/cloudreve/Cloudreve/v4, github.com/cloudreve/Cloudreve/v3. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2620b6156bafaad17f05b4b0abf14699"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-26T15:22:14.000Z","value":"7.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-58e117fc225db2eaadadebe6217de622"},{"kind":"CVSS","as_of":"2026-07-15T18:15:13.373Z","value":"7.1 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-2620b6156bafaad17f05b4b0abf14699"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-58e117fc225db2eaadadebe6217de622","url":"https://github.com/advisories/GHSA-w5fv-7x5q-g8qp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w5fv-7x5q-g8qp","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:37.775Z"},{"id":"sr-2620b6156bafaad17f05b4b0abf14699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54563","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-54563","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T01:48:19.229Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-58e117fc225db2eaadadebe6217de622"],"technology":"github.com/cloudreve/Cloudreve/v4","known_exclusions":[],"conditions_summary":"## Summary\n\nA Cloudreve WebDAV account stores a `uri` that defines the account's root folder. The WebDAV request handler (`stripPrefix` in `pkg/webdav/webdav.go`) trims the `/dav` prefix from the request path and joins the remainder to that root with `fs.URI.JoinRaw`, but never checks that the joined URI stays inside the root.\n\nGo's `net/http` decodes `%2e%2e` to `..` and `%2f` to `/` in `r.URL.Path` before the handler sees it, and `JoinRaw` resolves `..` segments through the standard library's `url.URL.JoinPath`. A request such as `GET /dav/%2e%2e/outside.txt` against a credential rooted at `cloudreve://my/restricted` therefore resolves to `cloudreve://my/outside.txt`. A scoped DAV credential can read and list files outside its configured folder; a writable scoped credential can also create, overwrite, move, and delete them.\n\nThe escape stays inside the same Cloudreve user's namespace because downstream DBFS owner checks still apply. It does not cross into another user's files or onto the OS filesystem. What it breaks is the per-folder WebDAV-account boundary — the entire reason scoped DAV accounts exist (delegating limited access to a sync client or a third party).\n\n## Technical ","public_affected_ranges":["< 4.0.0-20260606032813-26b6b1044b02"]},{"certainty":"source_listed","source_ids":["sr-58e117fc225db2eaadadebe6217de622"],"technology":"github.com/cloudreve/Cloudreve/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nA Cloudreve WebDAV account stores a `uri` that defines the account's root folder. The WebDAV request handler (`stripPrefix` in `pkg/webdav/webdav.go`) trims the `/dav` prefix from the request path and joins the remainder to that root with `fs.URI.JoinRaw`, but never checks that the joined URI stays inside the root.\n\nGo's `net/http` decodes `%2e%2e` to `..` and `%2f` to `/` in `r.URL.Path` before the handler sees it, and `JoinRaw` resolves `..` segments through the standard library's `url.URL.JoinPath`. A request such as `GET /dav/%2e%2e/outside.txt` against a credential rooted at `cloudreve://my/restricted` therefore resolves to `cloudreve://my/outside.txt`. A scoped DAV credential can read and list files outside its configured folder; a writable scoped credential can also create, overwrite, move, and delete them.\n\nThe escape stays inside the same Cloudreve user's namespace because downstream DBFS owner checks still apply. It does not cross into another user's files or onto the OS filesystem. What it breaks is the per-folder WebDAV-account boundary — the entire reason scoped DAV accounts exist (delegating limited access to a sync client or a third party).\n\n## Technical ","public_affected_ranges":["<= 3.0.0-20250225100611-da4e44b77af4"]}],"null_published_at":"2026-11-08T19:53:44.041Z","source_updated_at":"2026-08-26T15:22:14.000Z","source_disclosed_at":"2026-08-26T15:22:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-02T09:56:37.775Z"},{"id":"NVI-00014197","kind":"vulnerability","title":"Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-w5fv-7x5q-g8qp","CVE-2026-54563"],"plain_summary":"GitHub lists this reviewed advisory for github.com/cloudreve/Cloudreve/v4, github.com/cloudreve/Cloudreve/v3. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-58e117fc225db2eaadadebe6217de622"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-26T15:22:14.000Z","value":"7.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-58e117fc225db2eaadadebe6217de622"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-58e117fc225db2eaadadebe6217de622","url":"https://github.com/advisories/GHSA-w5fv-7x5q-g8qp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w5fv-7x5q-g8qp","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:37.775Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-58e117fc225db2eaadadebe6217de622"],"technology":"github.com/cloudreve/Cloudreve/v4","known_exclusions":[],"conditions_summary":"## Summary\n\nA Cloudreve WebDAV account stores a `uri` that defines the account's root folder. The WebDAV request handler (`stripPrefix` in `pkg/webdav/webdav.go`) trims the `/dav` prefix from the request path and joins the remainder to that root with `fs.URI.JoinRaw`, but never checks that the joined URI stays inside the root.\n\nGo's `net/http` decodes `%2e%2e` to `..` and `%2f` to `/` in `r.URL.Path` before the handler sees it, and `JoinRaw` resolves `..` segments through the standard library's `url.URL.JoinPath`. A request such as `GET /dav/%2e%2e/outside.txt` against a credential rooted at `cloudreve://my/restricted` therefore resolves to `cloudreve://my/outside.txt`. A scoped DAV credential can read and list files outside its configured folder; a writable scoped credential can also create, overwrite, move, and delete them.\n\nThe escape stays inside the same Cloudreve user's namespace because downstream DBFS owner checks still apply. It does not cross into another user's files or onto the OS filesystem. What it breaks is the per-folder WebDAV-account boundary — the entire reason scoped DAV accounts exist (delegating limited access to a sync client or a third party).\n\n## Technical ","public_affected_ranges":["< 4.0.0-20260606032813-26b6b1044b02"]},{"certainty":"source_listed","source_ids":["sr-58e117fc225db2eaadadebe6217de622"],"technology":"github.com/cloudreve/Cloudreve/v3","known_exclusions":[],"conditions_summary":"## Summary\n\nA Cloudreve WebDAV account stores a `uri` that defines the account's root folder. The WebDAV request handler (`stripPrefix` in `pkg/webdav/webdav.go`) trims the `/dav` prefix from the request path and joins the remainder to that root with `fs.URI.JoinRaw`, but never checks that the joined URI stays inside the root.\n\nGo's `net/http` decodes `%2e%2e` to `..` and `%2f` to `/` in `r.URL.Path` before the handler sees it, and `JoinRaw` resolves `..` segments through the standard library's `url.URL.JoinPath`. A request such as `GET /dav/%2e%2e/outside.txt` against a credential rooted at `cloudreve://my/restricted` therefore resolves to `cloudreve://my/outside.txt`. A scoped DAV credential can read and list files outside its configured folder; a writable scoped credential can also create, overwrite, move, and delete them.\n\nThe escape stays inside the same Cloudreve user's namespace because downstream DBFS owner checks still apply. It does not cross into another user's files or onto the OS filesystem. What it breaks is the per-folder WebDAV-account boundary — the entire reason scoped DAV accounts exist (delegating limited access to a sync client or a third party).\n\n## Technical ","public_affected_ranges":["<= 3.0.0-20250225100611-da4e44b77af4"]}],"null_published_at":"2026-11-02T10:00:37.223Z","source_updated_at":"2026-08-26T15:22:14.000Z","source_disclosed_at":"2026-08-26T15:22:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T09:56:37.775Z"}],"next_cursor":null,"snapshot_revision":"42594"}