PatchSiren

cloudreve CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH cloudreve CVE published 2026-04-03

CVE-2026-25726

CVE-2026-25726 is a high-severity vulnerability in Cloudreve, a self-hosted file management and sharing system. The vulnerability stems from the use of a weak pseudo-random number generator (math/rand) seeded with time.Now().UnixNano() to generate critical security secrets, including the secret_key and hash_id_salt. These secrets are generated upon first startup and stored in the database. An attacker can [truncated]