Cloudreve EUVD-2026-87980

Requires an authenticated Cloudreve user (PR:L) on a version before 4.16.1 with a remote downloader (e.g., aria2) configured. The attacker must be able to control the file paths reported by that downloader's metadata API (aria2.tellStatus().files[].path) - controlling the HTTP body of the downloaded URL is NOT sufficient, which is the AT:P attack requirement. Exploitation is further LIMITED because written files remain subject to Cloudreve's normal permission and upload checks and traversal cannot escape beyond the user's already-accessible namespace, so impact is confined to misplacing/overwriting files the user could already reach.

This is a genuinely low-priority issue whose signals are internally consistent. The vendor CVSS 4.0 score of 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N) correctly reflects an authenticated (PR:L) integrity-only (VI:L) flaw with no confidentiality or availability impact and an attack requirement (AT:P). No EPSS score, no CISA KEV listing, and no evidence of active exploitation are present in the input, so this should be treated as no public exploit weaponized in the wild. A proof-of-concept IS included in the GHSA advisory (a fake aria2 JSON-RPC service returning a traversal path), so exploit mechanics are public, but POC availability is distinct from active exploitation. The AT:P requirement is meaningful: the attacker must control the file paths reported by the configured remote downloader (e.g., aria2 tellStatus output), not merely the HTTP body of a downloaded URL - a non-trivial precondition. The advisory also confirms writes remain 'subject to Cloudreve's normal permission and upload checks' and are confined to the user's already-accessible namespace, which caps blast radius. No signals conflict; this is a low-severity, low-real-risk hardening fix rather than an urgent threat.

An authenticated Cloudreve user who can influence or operate the configured remote downloader (aria2) triggers a remote download whose downloader-reported filename contains '../../' sequences. Because Cloudreve joins the user-selected destination URI with the unsanitized downloader path via JoinRaw(), the file is written to a parent directory within the user's accessible namespace instead of the chosen folder. A working PoC using a fake aria2 JSON-RPC service is published in the GHSA advisory.