cve.bz

CVE-2026-55499

4.3 mediumEPSS 0.3%

Medium (4.3). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/cloudreve/Cloudreve/v4 4.0.0-20260613030215-0b00dd308f13.

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.

Severity

CVSS 3.1

4.3 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-w8x7-h2px-xmq8Gogithub.com/cloudreve/Cloudreve/v4<4.0.0-20260613030215-0b00dd308f134.0.0-20260613030215-0b00dd308f13
GHSA-w8x7-h2px-xmq8Gogithub.com/cloudreve/Cloudreve/v3<=3.0.0-20250225100611-da4e44b77af4no fix published
GO-2026-6102Gogithub.com/cloudreve/Cloudreveall versionsno fix published
GO-2026-6102Gogithub.com/cloudreve/Cloudreve/v3all versionsno fix published
GO-2026-6102Gogithub.com/cloudreve/Cloudreve/v4<4.0.0-20260613030215-0b00dd308f134.0.0-20260613030215-0b00dd308f13

References

Check your stackJSON