{"vulnerability": "GHSA-W8J7-39HP-8X59", "sightings": [{"uuid": "70a5c80f-9166-4ca4-9500-25acb6be35a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-W8J7-39HP-8X59", "type": "seen", "source": "https://gist.github.com/alon710/f4870b690aa1da14f92ae69cc23adaf4", "content": "# GHSA-W8J7-39HP-8X59: GHSA-W8J7-39HP-8X59: Path Traversal Vulnerability in Cloudreve Remote Downloader Workflow\n\n> **CVSS Score:** 5.5\n> **Published:** 2026-08-24\n> **Full Report:** https://cvereports.com/reports/GHSA-W8J7-39HP-8X59\n\n## Summary\nA path traversal vulnerability exists in Cloudreve's remote download workflow, where improper sanitization of file paths returned by configured remote downloaders (such as aria2) allows authenticated users to write files outside the designated target folder.\n\n## TL;DR\nAuthenticated users can write files outside target directories by exploiting missing path-traversal validation in Cloudreve's integration with remote downloaders like aria2.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v4.0**: 5.5\n- **Exploit Status**: PoC Available\n- **Impact**: Partial Integrity (Unintended File Placement)\n- **Privileges Required**: Authenticated User\n\n## Affected Systems\n\n- Cloudreve\n- **Cloudreve**: <= 4.0.0-20260606032813-26b6b1044b02 (Fixed in: `None`)\n\n## Mitigation\n\n- Disable remote downloader configurations if not strictly needed\n- Restrict remote download capabilities to trusted administrators\n- Implement strict endpoint access controls for the aria2 JSON-RPC interface\n\n**Remediation Steps:**\n1. Audit configured remote download servers in the Cloudreve administration panel\n2. Ensure aria2 RPC credentials are secure and not publicly exposed\n3. Apply source-level patches to `pkg/filemanager/workflows/remote_download.go` to validate filenames\n4. Recompile Cloudreve from the patched source code tree\n\n## References\n\n- [GitHub Security Advisory Details](https://github.com/advisories/GHSA-W8J7-39HP-8X59)\n- [Cloudreve Security Advisory](https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8j7-39hp-8x59)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-W8J7-39HP-8X59) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T10:32:31.731796Z"}]}