CVE-2026-54563: Cloudreve Path Traversal Vulnerability

CVE-2026-54563 Overview

Cloudreve is a self-hosted file management and sharing system that supports WebDAV access for scoped user accounts. A path traversal vulnerability in Cloudreve versions prior to 4.16.1 allows authenticated WebDAV users to escape their configured root folder using URL-encoded traversal sequences. The flaw resides in the stripPrefix function within pkg/webdav/webdav.go, which joins the decoded request suffix to the account root via fs.URI.JoinRaw without containment validation. Attackers holding scoped WebDAV credentials can read, list, create, overwrite, move, or delete files outside their assigned folder. The issue is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated WebDAV users can bypass folder scoping to access arbitrary files across the Cloudreve instance, breaking multi-tenant isolation.

Affected Products

Cloudreve versions prior to 4.16.1
Cloudreve WebDAV endpoint (pkg/webdav/webdav.go)
Self-hosted Cloudreve deployments exposing scoped WebDAV credentials

Discovery Timeline

2026-07-15 - CVE-2026-54563 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-54563

Vulnerability Analysis

The vulnerability is a path traversal flaw in Cloudreve's WebDAV request handling layer. Cloudreve permits administrators to create WebDAV accounts scoped to a specific folder, expecting the server to enforce that boundary on every operation. The stripPrefix function in pkg/webdav/webdav.go strips the /dav prefix from an incoming request and appends the remainder to the account's configured root path.

Because the function relies on fs.URI.JoinRaw to combine these components, it accepts URL-encoded traversal sequences such as %2e%2e without normalizing or validating the resulting path against the account boundary. A request targeting /dav/%2e%2e/outside.txt therefore resolves to a location outside the scoped folder. The server then honors the operation using the account's credentials, permitting read, list, write, move, or delete actions depending on the credential's assigned permissions.

Root Cause

The root cause is missing containment enforcement after path concatenation. fs.URI.JoinRaw performs a raw join that does not resolve .. segments or verify that the final path remains within the account root. This is an incorrect authorization issue [CWE-863], where the server trusts a normalized URL prefix without re-validating the fully resolved filesystem target against the credential's scope.

Attack Vector

Exploitation requires valid low-privileged WebDAV credentials but no user interaction. An attacker sends a WebDAV verb such as GET, PUT, MOVE, or DELETE to a /dav/ URL containing URL-encoded parent-directory sequences. The server decodes the suffix, joins it to the account root without normalization, and executes the operation against the traversed path. Read-only credentials expose file contents and directory listings; writable credentials allow arbitrary create, overwrite, move, and delete operations on files outside the intended scope.

The vulnerability manifests in the stripPrefix function in pkg/webdav/webdav.go. Refer to the Cloudreve GitHub Security Advisory GHSA-w5fv-7x5q-g8qp for the technical writeup and patch commit.

Detection Methods for CVE-2026-54563

Indicators of Compromise

WebDAV request paths containing URL-encoded traversal sequences such as %2e%2e, %2E%2E, or mixed-case variants under the /dav/ route
Access logs showing WebDAV accounts operating on file paths outside their configured root folder
Unexpected PUT, MOVE, COPY, or DELETE operations targeting system or other tenants' directories
File integrity changes on Cloudreve storage backends not attributable to administrator activity

Detection Strategies

Parse Cloudreve access logs for /dav/ requests containing %2e, %2E, or literal .. segments after URL decoding
Correlate WebDAV account identifiers with the resolved filesystem paths to flag operations outside the account's scoped root
Alert on WebDAV verbs (PUT, DELETE, MOVE) executed against paths not owned by the acting principal

Monitoring Recommendations

Enable verbose HTTP access logging on the reverse proxy fronting Cloudreve to capture raw request URIs before decoding
Forward Cloudreve and proxy logs to a centralized analytics platform for long-term retention and query
Review WebDAV credential inventory and audit which accounts have write permissions on shared storage volumes

How to Mitigate CVE-2026-54563

Immediate Actions Required

Upgrade Cloudreve to version 4.16.1 or later, which contains the fix for the stripPrefix containment check
Rotate all WebDAV account credentials after upgrading in case existing credentials were abused
Audit filesystem contents in each scoped WebDAV root for unexpected files, deletions, or modifications

Patch Information

The vulnerability is fixed in Cloudreve 4.16.1. The patch adds containment validation after the request suffix is joined to the account root, rejecting requests whose resolved path escapes the configured folder. Full patch details are documented in the Cloudreve GitHub Security Advisory GHSA-w5fv-7x5q-g8qp.

Workarounds

Disable WebDAV access in Cloudreve until upgrading to 4.16.1 if immediate patching is not possible
Restrict WebDAV endpoints at the reverse proxy layer to block request URIs containing %2e%2e, %2E%2E, or .. sequences
Limit WebDAV account permissions to read-only where write access is not strictly required to reduce blast radius

bash

# Example NGINX rule to block encoded traversal on the /dav/ route
location /dav/ {
    if ($request_uri ~* "(%2e%2e|%2E%2E|\.\./)") {
        return 400;
    }
    proxy_pass http://cloudreve_backend;
}