CVE-2026-101051: Cloudreve Path Traversal Vulnerability

CVE-2026-101051 Overview

Cloudreve versions prior to 4.16.1 contain a path traversal vulnerability [CWE-22] in the remote downloader component. The application fails to sanitize file paths returned by remote downloaders, allowing authenticated users to write files outside the selected destination directory. Attackers supply path traversal sequences in downloader metadata to place files in unintended locations within accessible namespaces. The flaw requires valid authentication and user interaction with the downloader workflow, limiting its reach to users with legitimate access to the file management features.

Critical Impact
Authenticated attackers can write files to arbitrary paths within reachable storage namespaces, potentially overwriting existing files or planting content in sensitive directories.

Affected Products

Cloudreve versions prior to 4.16.1
Deployments exposing the remote download feature to authenticated users
Self-hosted Cloudreve instances with multi-user access

Discovery Timeline

2026-09-27 - CVE-2026-101051 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101051

Vulnerability Analysis

Cloudreve supports remote downloading, where the server retrieves content from an external source and stores it in a user-selected destination directory. The remote downloader returns metadata including the filename or relative path of each downloaded item. Cloudreve before 4.16.1 consumes this metadata without validating that the resulting path remains inside the chosen destination.

An authenticated attacker can craft or influence downloader output to include path traversal sequences such as ../. When Cloudreve joins the destination directory with the attacker-controlled path, the resolved target escapes the intended folder. The attacker then writes files to any location within namespaces reachable by the Cloudreve process.

The impact is bounded by the storage namespaces and permissions available to the running service. Overwriting configuration files, planting content in other users' directories, or seeding files in web-accessible paths are plausible outcomes depending on deployment.

Root Cause

The root cause is insufficient path sanitization at the boundary between the remote downloader and the storage layer. Cloudreve trusted the filename metadata from downloader responses rather than canonicalizing the resolved path and verifying it stays within the destination directory.

Attack Vector

Exploitation requires network access to the Cloudreve web interface and valid low-privileged credentials. The attacker initiates a remote download task where downloader metadata contains traversal sequences. Cloudreve writes the file to the attacker-chosen location on completion. See the GitHub Security Advisory and the VulnCheck Path Traversal Advisory for technical specifics.

Detection Methods for CVE-2026-101051

Indicators of Compromise

Files written to directories not previously used by the Cloudreve service account
Remote download task records referencing filenames containing .., /, or \ sequences
Unexpected modifications to Cloudreve configuration files, user data directories, or static web assets
Audit log entries showing download completions with paths outside configured upload roots

Detection Strategies

Review Cloudreve application logs for remote download tasks whose stored path differs from the user-selected destination
Monitor the filesystem under the Cloudreve data root for file creations outside expected per-user directories
Alert on process writes by the Cloudreve service to paths such as configuration directories, web roots, or system binaries

Monitoring Recommendations

Enable verbose logging on the remote downloader subsystem and forward logs to a central SIEM for correlation
Baseline normal remote download destinations per user and flag deviations
Track Cloudreve version strings across deployments to confirm patched builds are in use

How to Mitigate CVE-2026-101051

Immediate Actions Required

Upgrade all Cloudreve instances to version 4.16.1 or later
Audit existing remote download task history for suspicious filenames containing traversal sequences
Review file storage for unexpected files created by the Cloudreve service account since deployment
Rotate any secrets stored in locations the Cloudreve process can write to, if compromise is suspected

Patch Information

The Cloudreve maintainers addressed the issue in version 4.16.1 by sanitizing paths returned by remote downloaders. Patch details and the fixed commit are documented in the GitHub Security Advisory GHSA-w8j7-39hp-8x59.

Workarounds

Disable the remote download feature until the upgrade is applied
Restrict remote download permissions to a small set of trusted administrative accounts
Run Cloudreve under a dedicated unprivileged user with filesystem access limited to its data directory
Place the Cloudreve data directory on a filesystem mount separate from configuration and application binaries

bash

# Example: restrict Cloudreve service account filesystem reach via systemd
[Service]
User=cloudreve
Group=cloudreve
ReadWritePaths=/var/lib/cloudreve/data
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true