CVE-2026-62323

6.3 Moyenne

Publiée le 31/07/2026 à 06:17 · Modifiée le 08/09/2026 à 22:51 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token suffix and invoke WOPI write routes for the underlying file. This issue is fixed in version 4.17.0.

Traduire en français

Produits concernés

cloudreve

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N`

Faiblesses (CWE)

CWE-863

Références

https://github.com/cloudreve/cloudreve/commit/f3347130ac48f2ff996af9ef66c97be2dda9cba9
https://github.com/cloudreve/cloudreve/releases/tag/4.17.0
https://github.com/cloudreve/cloudreve/security/advisories/GHSA-c3jm-gv5r-9wcp
https://github.com/cloudreve/cloudreve/security/advisories/GHSA-c3jm-gv5r-9wcp

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories