These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-101051 is a low-severity vulnerability in Cloudreve before version 4.16.1. The issue allows authenticated users to create files outside the selected destination directory by exploiting path traversal sequences in downloader metadata. This CVE was published on 2026-09-27T18:16:31.510Z and has not been modified since then. The vulnerability has a CVSS score of 2.3 and is considered low-severity. De [truncated]
CVE-2026-101056 debrief based on the supplied source corpus. The CVE record was published on 2026-09-27T18:16:31.667Z and has not been modified since then. This medium-severity vulnerability in Cloudreve allows attackers to bypass share access revalidation, potentially leading to unauthorized access to shared files. Defenders should assess exposure and prioritize upgrading to version 4.16.1 or later. The [truncated]
CVE-2026-101048 is a medium-severity vulnerability in Cloudreve before version 4.17.0 that allows for blind server-side request forgery (SSRF) due to insufficient OAuth scope checks for administrative node test endpoints. This vulnerability enables an OAuth client with only the Admin.Read scope to submit attacker-controlled node definitions, causing the Cloudreve server to issue outbound requests to arbit [truncated]
CVE-2026-77633 is a vulnerability in Cloudreve, a self-hosted file management and sharing system, prior to version 4.18.0. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota a [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T04:17:24.160Z and has not been modified since then. Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised [truncated]
CVE-2026-55502 is a high-severity vulnerability in Cloudreve's file management and sharing system, affecting versions prior to 4.17.0. The vulnerability class is related to improper access control, specifically in the POST /api/v4/admin/policy/oauth/signin endpoint, which requires only Admin.Read privileges. This allows an attacker to persist caller-supplied OneDrive secret and app_id values, potentially [truncated]
CVE-2026-55497 is a denial-of-service vulnerability in Cloudreve versions prior to 4.17.0. An authenticated user can submit a crafted image that causes an out-of-memory condition, terminating the Cloudreve process. The vulnerability is due to the built-in thumbnail and avatar image decoders limiting compressed file size but not decoded pixel dimensions. This issue can be mitigated by updating to version 4 [truncated]
CVE-2026-55496 debrief based on CVE Program and NVD records. Cloudreve, a self-hosted file management and sharing system, had a vulnerability prior to version 4.17.0 that allowed any logged-in user to enumerate email addresses and profile metadata for inactive or banned accounts. The vulnerability was due to GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializing [truncated]
Cloudreve self-hosted file management system has a vulnerability prior to version 4.17.0. The WOPI PUT_RELATIVE handler incorrectly processes file paths, potentially allowing overwrite of files outside intended directories within the same owner account. This could lead to limited scope elevation of privileges. Affected product deployments should be identified and owners assigned for follow-up. Official ad [truncated]
CVE-2026-25726 is a high-severity vulnerability in Cloudreve, a self-hosted file management and sharing system. The vulnerability stems from the use of a weak pseudo-random number generator (math/rand) seeded with time.Now().UnixNano() to generate critical security secrets, including the secret_key and hash_id_salt. These secrets are generated upon first startup and stored in the database. An attacker can [truncated]