These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T04:17:24.160Z and has not been modified since then. Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised [truncated]
CVE-2026-55502 is a high-severity vulnerability in Cloudreve's file management and sharing system, affecting versions prior to 4.17.0. The vulnerability class is related to improper access control, specifically in the POST /api/v4/admin/policy/oauth/signin endpoint, which requires only Admin.Read privileges. This allows an attacker to persist caller-supplied OneDrive secret and app_id values, potentially [truncated]
CVE-2026-55497 is a denial-of-service vulnerability in Cloudreve versions prior to 4.17.0. An authenticated user can submit a crafted image that causes an out-of-memory condition, terminating the Cloudreve process. The vulnerability is due to the built-in thumbnail and avatar image decoders limiting compressed file size but not decoded pixel dimensions. This issue can be mitigated by updating to version 4 [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T04:17:22.877Z and has not been modified since then. Cloudreve self-hosted file management and sharing system has a vulnerability prior to version 4.17.0, allowing logged-in users to enumerate email addresses and profile metadata for inactive or banned accounts via the GET /api/v4/user/search endp [truncated]
Cloudreve self-hosted file management system has a vulnerability prior to version 4.17.0. The WOPI PUT_RELATIVE handler incorrectly processes file paths, potentially allowing overwrite of files outside intended directories within the same owner account. This could lead to limited scope elevation of privileges. Affected product deployments should be identified and owners assigned for follow-up. Official ad [truncated]
CVE-2026-25726 is a high-severity vulnerability in Cloudreve, a self-hosted file management and sharing system. The vulnerability stems from the use of a weak pseudo-random number generator (math/rand) seeded with time.Now().UnixNano() to generate critical security secrets, including the secret_key and hash_id_salt. These secrets are generated upon first startup and stored in the database. An attacker can [truncated]