What is the CVSS score of CVE-2026-54563?

CVE-2026-54563 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Cloudreve are affected by CVE-2026-54563?

Cloudreve, a self-hosted file storage platform, contains a vulnerability in versions prior to 4.16.1 that allows users with WebDAV credentials to access and modify files beyond their assigned…. A patch is available.

Is there a public PoC exploit available for CVE-2026-54563?

Yes, a public proof-of-concept exploit is available for CVE-2026-54563. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-54563?

Within 24 hours, inventory Cloudreve deployments, identify affected versions (prior to 4.16.1), and list all accounts with WebDAV access. Within 7 days, disable WebDAV where not essential, enforce operating system file permissions to limit Cloudreve process scope, and enable file access logging to detect suspicious activity. Within 30 days, establish a process to deploy version 4.16.1 or later upon release, and evaluate whether delegated file access needs can be met through alternative methods with stronger access controls.

Cloudreve CVE-2026-54563

EUVD-2026-44688 HIGH

Incorrect Authorization (CWE-863)

2026-07-15 GitHub_M

GHSA-w5fv-7x5q-g8qp

Authentication Bypass Suse Cloudreve

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.3 HIGH

Network-reachable /dav with low complexity and no UI; requires an existing scoped WebDAV credential (PR:L); writable credentials can overwrite and delete arbitrary files (C:H/I:H) and deletion affects availability (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Analysis Generated

Jul 15, 2026 - 15:22 vuln.today

CVE Published

Jul 15, 2026 - 14:38 cve.org

HIGH 7.1

DescriptionCVE.org

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.

AnalysisAI

Path traversal via improper authorization in Cloudreve's WebDAV handler lets a scoped WebDAV account escape its configured root folder, reading and listing files anywhere the server process can reach, and - with a writable credential - creating, overwriting, moving, or deleting them. All versions prior to 4.16.1 are affected. No public exploit is identified at time of analysis and it is not listed in CISA KEV, though the flaw is straightforward to trigger once a low-privileged WebDAV credential is held.

Technical ContextAI

Cloudreve is a self-hosted file management and sharing platform written in Go. The vulnerability lives in the WebDAV subsystem (pkg/webdav/webdav.go): the stripPrefix routine URL-decodes the request path suffix and joins it to the account's configured root using fs.URI.JoinRaw without verifying that the resulting path stays contained within that root. Because decoding happens before any containment check, an encoded traversal sequence such as %2e%2e (a percent-encoded '..') slips past the intended sandbox. This is a classic CWE-863 (Improper Authorization) failure - the scoping boundary that ties a WebDAV credential to a specific folder is not enforced on the resolved path. The single affected package is cpe:2.3:a:cloudreve:cloudreve:*.

RemediationAI

Vendor-released patch: upgrade to Cloudreve 4.16.1 or later, which adds the missing containment check to WebDAV path resolution, per advisory GHSA-w5fv-7x5q-g8qp (https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp). If immediate upgrade is not possible, reduce exposure by disabling the WebDAV feature entirely or revoking WebDAV credentials until patched (trade-off: breaks legitimate WebDAV sync clients); at minimum, downgrade any writable WebDAV credentials to read-only to remove the create/overwrite/move/delete capability, and restrict network reachability of the /dav endpoint to trusted networks or place it behind a reverse proxy that normalizes and rejects encoded '..' sequences (trade-off: proxy filtering is a partial control and may miss some encodings). Rotate credentials afterward in case scoped accounts were abused.