PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55495 cloudreve CVE debrief

Cloudreve self-hosted file management system has a vulnerability prior to version 4.17.0. The WOPI PUT_RELATIVE handler incorrectly processes file paths, potentially allowing overwrite of files outside intended directories within the same owner account. This could lead to limited scope elevation of privileges. Affected product deployments should be identified and owners assigned for follow-up. Official advisories and CVE records should be reviewed to validate affected scope, severity, and vendor guidance.

Vendor
cloudreve
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-31
Original CVE updated
2026-09-08
Advisory published
2026-07-31
Advisory updated
2026-09-08

Who should care

Cloudreve users and administrators, security teams monitoring file management systems, and operators responsible for system updates and security should be aware of this vulnerability. They should review and apply vendor-provided patches if vulnerable, inventory and verify Cloudreve system versions, and monitor system logs for suspicious activity. Compensating controls for sensitive file access should be implemented, and system configurations should be reviewed to ensure proper authorization. Exceptions should be tracked, and remediated assets retested.

Technical summary

CVE-2026-55495 is a vulnerability in Cloudreve self-hosted file management system prior to version 4.17.0. The WOPI PUT_RELATIVE handler incorrectly processes file paths, potentially allowing overwrite of files outside intended directories within the same owner account. This could lead to limited scope elevation of privileges. The vulnerability has been fixed in version 4.17.0. Affected product context and defensive impact should be considered when assessing this vulnerability.

Defensive priority

Medium-priority defensive review recommended due to potential for limited scope elevation of privileges.

Recommended defensive actions

  • Review and apply vendor-provided patch version 4.17.0 if vulnerable
  • Inventory and verify Cloudreve system versions
  • Monitor system logs for suspicious activity
  • Implement compensating controls for sensitive file access
  • Review system configurations and ensure proper authorization
  • Track exceptions and retest remediated assets
  • Verify patch application and system security

Evidence notes

Evidence primarily from official CVE and NVD sources; vulnerability details and impact assessment limited by available data. The CVE record was published on 2026-07-31T04:17:22.597Z and has not been modified since then. Limited information available on affected scope and potential impact. Defenders should verify system versions and apply patches if vulnerable.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-55495 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-55495

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-55495 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55495

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.