Vulnerability Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite files elsewhere in the same owner account. This issue is fixed in version 4.17.0.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/cloudreve/cloudreve/commit/7968e50429efab40ffa8f57fecdfbd5a73
- https://github.com/cloudreve/cloudreve/releases/tag/4.17.0
- https://github.com/cloudreve/cloudreve/security/advisories/GHSA-49h3-cwhj-4737
- https://github.com/cloudreve/cloudreve/security/advisories/GHSA-49h3-cwhj-4737
FAQ
What is CVE-2026-55495?
CVE-2026-55495 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing sl...
How severe is CVE-2026-55495?
CVE-2026-55495 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55495?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.