CVE-2026-55499

4.3 Moyenne

Publiée le 31/07/2026 à 06:17 · Modifiée le 08/09/2026 à 22:51 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.

Traduire en français

Produits concernés

cloudreve

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-863

Références

https://github.com/cloudreve/cloudreve/commit/0b00dd308f132d6e6e8476857ef79f4865600bbc
https://github.com/cloudreve/cloudreve/releases/tag/4.17.0
https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8
https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories