CVE-2026-55495: Cloudreve Path Traversal Vulnerability

CVE-2026-55495 Overview

Cloudreve is a self-hosted file management and sharing system. CVE-2026-55495 is a path traversal vulnerability [CWE-22] affecting Cloudreve versions prior to 4.17.0. The Web Application Open Platform Interface (WOPI) PUT_RELATIVE handler passes the X-WOPI-SuggestedTarget header value to URI.JoinRaw as a path rather than a filename. This allows slash and dot-dot segments to escape the source file directory. An authenticated attacker can create or conditionally overwrite files elsewhere within the same owner account. The issue is fixed in version 4.17.0.

Critical Impact
An authenticated attacker exploiting the WOPI PUT_RELATIVE handler can escape the source directory and write files to arbitrary locations within the same owner account, enabling file overwrite and integrity compromise.

Affected Products

Cloudreve versions prior to 4.17.0
Cloudreve WOPI integration component (pkg/wopi/wopi.go)
Self-hosted Cloudreve deployments with WOPI-enabled office document editing

Discovery Timeline

2026-07-31 - CVE-2026-55495 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-55495

Vulnerability Analysis

Cloudreve integrates with WOPI-compatible office suites to support collaborative file editing. When a client issues a PUT_RELATIVE request, the server uses the X-WOPI-SuggestedTarget header to determine the target filename for the new file. In vulnerable versions, this header value is passed to URI.JoinRaw and treated as a URI path segment. The WOPI protocol expects SuggestedTarget to be a filename, not a path.

Because the handler does not strip or reject path separators, an attacker can supply values containing forward slashes and .. segments. These segments are joined against the source file's directory URI, allowing the resulting path to resolve outside the intended directory. The scope is confined to files owned by the same account executing the request.

Root Cause

The root cause is improper input validation in the WOPI handler in pkg/wopi/wopi.go. The code treats the X-WOPI-SuggestedTarget header as a URI path fragment rather than a bare filename. URI.JoinRaw performs URI-aware joining that honors relative path traversal semantics, so .. and / characters in the header propagate into the final resolved location. Filename sanitization and separator stripping were missing before the fix.

Attack Vector

An authenticated attacker with access to a Cloudreve account that supports WOPI editing sends a PUT_RELATIVE request to the WOPI endpoint. The attacker sets the X-WOPI-SuggestedTarget header to a value containing ../ sequences and a target filename. The server resolves the traversal and writes the uploaded content to a directory outside the source file's location, within the same owner's storage namespace.

// Vulnerable behavior (pre-4.17.0) in pkg/wopi/wopi.go
// X-WOPI-SuggestedTarget was passed to URI.JoinRaw as a path,
// permitting slash and dot-dot segments to escape the source directory.
//
// Fix commit 7968e50429efab40ffa8f57fecdfbd5a73d23630:
// "fix(WOPI): SuggestedTarget header should not accept file path"
//
// The patch treats SuggestedTarget as a filename only, rejecting or
// stripping path separators before joining with the source directory URI.

Source: GitHub Commit 7968e504

Detection Methods for CVE-2026-55495

Indicators of Compromise

WOPI PUT_RELATIVE requests containing X-WOPI-SuggestedTarget header values with ../ sequences or forward slashes.
Unexpected files appearing in directories the WOPI editor should not touch, owned by accounts that used office document editing.
Cloudreve access logs showing PUT_RELATIVE operations followed by file creations outside the originating document's folder.

Detection Strategies

Inspect Cloudreve application logs for WOPI PUT_RELATIVE requests and validate that the SuggestedTarget header contains only a filename with no path separators.
Deploy a reverse-proxy or web application firewall rule that blocks X-WOPI-SuggestedTarget header values containing /, \, or .. substrings.
Correlate WOPI request timestamps with filesystem or object-store write events to identify writes outside expected directories.

Monitoring Recommendations

Enable verbose logging on the WOPI endpoint and forward logs to a centralized analytics platform for anomaly review.
Alert on any Cloudreve version banner reporting a release earlier than 4.17.0 discovered during asset scans.
Track per-user file creation rates and directory diversity to surface accounts writing to unusual paths.

How to Mitigate CVE-2026-55495

Immediate Actions Required

Upgrade Cloudreve to version 4.17.0 or later, which contains the fix from commit 7968e504.
Audit existing Cloudreve storage for files created via WOPI PUT_RELATIVE in unexpected locations and review their contents.
Restrict WOPI endpoint access to trusted networks or authenticated office-editor clients until the upgrade is complete.

Patch Information

The vulnerability is fixed in Cloudreve 4.17.0. The patch in pkg/wopi/wopi.go treats the X-WOPI-SuggestedTarget header as a filename only, rejecting path separators before joining with the source directory URI. See the GitHub Security Advisory GHSA-49h3-cwhj-4737 and the GitHub Release 4.17.0 for full details.

Workarounds

Place a reverse proxy in front of Cloudreve that strips or rejects X-WOPI-SuggestedTarget header values containing /, \, or ...
Disable WOPI integration until the upgrade to 4.17.0 can be applied if office document editing is not business-critical.
Limit which authenticated users can invoke WOPI editing to reduce the population of accounts that can exercise the vulnerable code path.

bash

# Example nginx rule to block traversal in the WOPI SuggestedTarget header
if ($http_x_wopi_suggestedtarget ~* "(\.\./|\.\.\\|/|\\)") {
    return 400;
}