https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T15:53:19.670069+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-62323 CVE-2026-62323 — Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored 2026-09-30T15:53:19.687044+00:00

Affected: cloudreve

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token suffix and invoke WOPI write routes for the underlying file. This issue is fixed in version 4.17.0.