CVE-2026-54563: Path Traversal and Incorrect Authorization in Cloudreve WebDAV Component
Vulnerability ID: CVE-2026-54563
CVSS Score: 7.1
Published: 2026-08-26
A high-severity path traversal vulnerability in Cloudreve's WebDAV component allows authenticated users with scoped WebDAV credentials to bypass directory containment limits and access unauthorized filesystem areas.
TL;DR
Authenticated users with restricted WebDAV credentials can use URL-encoded path traversal sequences to access, read, or modify files outside their designated root directory.
Technical Details
- CWE ID: CWE-863 (Incorrect Authorization)
- Attack Vector: Network (AV:N)
- CVSS Score: 7.1 (High)
- EPSS Score: 0.00315 (Percentile: 23.79%)
- Impact: Confidentiality (High), Integrity (Low)
- Exploit Status: None
- KEV Status: Not Listed
Affected Systems
- Cloudreve
Mitigation Strategies
- Upgrade Cloudreve to version 4.16.1 or newer.
- Review existing WebDAV scopes and revoke credentials exposed to untrusted environments until patched.
Remediation Steps:
- Identify running installations of Cloudreve below version 4.16.1.
- Obtain the 4.16.1 release binary or build from source.
- Stop the Cloudreve service.
- Replace the binary and restart the service.
- Verify security remediation by attempting to access a parent folder with restricted credentials.
Read the full report for CVE-2026-54563 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)