Vulnerability Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/cloudreve/cloudreve/commit/0b00dd308f132d6e6e8476857ef79f4865
- https://github.com/cloudreve/cloudreve/releases/tag/4.17.0
- https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8
- https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8
FAQ
What is CVE-2026-55499?
CVE-2026-55499 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to tha...
How severe is CVE-2026-55499?
CVE-2026-55499 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55499?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.