{"cve":"CVE-2026-45727","nvd":{"published":"2026-06-01T19:16:53.003","modified":"2026-07-22T08:10:00.117","status":"Deferred","description":"CloakBrowser is a tool to bypass bot detection tests. Prior to version 0.3.28, the cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted fingerprint value containing path traversal sequences to resolve user_data_dir outside the configured data_dir. When Chrome fails to start or the process is cleaned up, shutil.rmtree() deletes the traversed path, resulting in arbitrary directory deletion. Additionally, cloakserve bound to 0.0.0.0 by default, making it network-exposed. This issue has been patched in version 0.3.28.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","score":8.8},"cvss_v3":null,"cwes":["CWE-22"],"references":["https://github.com/CloakHQ/CloakBrowser/security/advisories/GHSA-mf33-gv72-w2h5"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:37:48.043517290+00:00"},"epss":{"cve":"CVE-2026-45727","score":0.00475,"percentile":0.411,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-mf33-gv72-w2h5","url":"https://osv.dev/vulnerability/GHSA-mf33-gv72-w2h5","summary":"CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion","modified":"2026-07-13T16:43:27.834173887Z","packages":[{"ecosystem":"PyPI","name":"cloakbrowser","purl":"pkg:pypi/cloakbrowser","ranges":["<0.3.28"],"fixed":["0.3.28"]}]},{"id":"PYSEC-2026-2420","url":"https://osv.dev/vulnerability/PYSEC-2026-2420","summary":"CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion","modified":"2026-07-13T16:31:42.471778574Z","packages":[{"ecosystem":"PyPI","name":"cloakbrowser","purl":"pkg:pypi/cloakbrowser","ranges":["<0.3.28"],"fixed":["0.3.28"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}