Vulnerabilidades em Cloudreve
11 resultadosAnálise Vexday
O Cloudreve apresenta um perfil de risco mínimo com apenas uma vulnerabilidade registrada na base, sem evidência de exploração ativa em campo. A fraqueza identificada é do tipo XSS (CWE-79), de severidade não-crítica, e não há indícios de descoberta recente, reduzindo a urgência de resposta.
CVE-2026-55497MEDIUMCloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)EPSS 0.5%CVE-2022-32167MEDIUMCloudreve - Stored XSSEPSS 0.5%CVE-2026-25726HIGHCloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)EPSS 0.4%CVE-2026-55495MEDIUMCloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner AccountEPSS 0.4%CVE-2026-55496MEDIUMCloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicateEPSS 0.4%CVE-2026-55502HIGHCloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentialsEPSS 0.3%CVE-2026-55499MEDIUMCloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipientsEPSS 0.3%CVE-2026-62323MEDIUMCloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignoredEPSS 0.3%CVE-2026-54560HIGHCloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claimEPSS 0.2%CVE-2026-54562MEDIUMCloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responsesEPSS 0.2%CVE-2026-54563HIGHCloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account rootEPSS 0.2%