CVE-2026-54563 Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root
Attackers with scoped WebDAV credentials can escape their configured root directory to read, modify, or delete files outside the intended scope.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54563?
CVE-2026-54563 is a high-severity path traversal vulnerability in cloudreve, published on 15 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the configured folder and writable credentials to create, overwrite, move, or delete them. This issue is reported as fixed in version 4.16.1.
Weakness: CWE-863
Which versions are affected by CVE-2026-54563?
7 open source packages ship an affected version, including github.com/cloudreve/Cloudreve/v3, github.com/cloudreve/Cloudreve and github.com/cloudreve/Cloudreve/v4.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cloudreve/Cloudreve/v3 Go | All versions | None |
github.com/cloudreve/Cloudreve/v3 Go | All versions to 3.0.0-20250225100611-da4e44b77af4 | None |
github.com/cloudreve/Cloudreve/v3 Go | All versions to 3.0.0-20250225100611-da4e44b77af4 | None |
github.com/cloudreve/Cloudreve Go | All versions | None |
github.com/cloudreve/Cloudreve/v4 Go | All versions | 4.0.0-20260606032813-26b6b1044b02 |
github.com/cloudreve/Cloudreve/v4 Go | All versions | 4.0.0-20260606032813-26b6b1044b02 |
1 more packages
github.com/cloudreve/Cloudreve/v4 Go | All versions | 4.0.0-20260606032813-26b6b1044b02 |
How do I fix CVE-2026-54563?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54563 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54563 exists.
Sources
Also known as GHSA-w5fv-7x5q-g8qp, GO-2026-6298.