{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cloudreve-v4--4.0.0-20260715025621-7329602751c0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cloudreve:cloudreve:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-77633"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cloudreve (v4 \u003c 4.0.0-20260715025621-7329602751c0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Cloudreve"],"content_html":"\u003cp\u003eCloudreve v4 is vulnerable to a TOCTOU race condition within its \u003ccode\u003ePrepareUpload\u003c/code\u003e function, which governs how user storage quotas are enforced. The application fails to perform atomic quota checks and balance updates, separating the process into two distinct stages: a check (reading the current \u003ccode\u003eused\u003c/code\u003e byte count from the database) and a charge (incrementing the \u003ccode\u003eusers.storage\u003c/code\u003e field).\u003c/p\u003e\n\u003cp\u003eBecause these operations are not enclosed within a database-level transaction lock (e.g., \u003ccode\u003eSELECT ... FOR UPDATE\u003c/code\u003e), multiple concurrent upload requests can read the same stale storage snapshot. This enables attackers to bypass \u003ccode\u003eMaxStorage\u003c/code\u003e limits defined by their user group. By sending multiple simultaneous requests, an attacker can reserve storage far exceeding their actual quota. This primitive is trivially escalated to a storage-based denial of service, where the reserved storage eventually materializes as actual file data written to disk, potentially exhausting the host's physical free space and disrupting service for all users. This vulnerability impacts all default deployments of Cloudreve v4 prior to version 4.0.0-20260715025621-7329602751c0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Cloudreve instance using a standard user account with \u003ccode\u003eFiles.Write\u003c/code\u003e permissions.\u003c/li\u003e\n\u003cli\u003eAttacker initiates multiple concurrent upload sessions (e.g., via script) targeting the \u003ccode\u003ePrepareUpload\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eDBFS.validateUserCapacity\u003c/code\u003e function for each request fetches the \u003ccode\u003eused\u003c/code\u003e storage value from the database snapshot simultaneously.\u003c/li\u003e\n\u003cli\u003eEach request process performs a validation check against the user's \u003ccode\u003eMaxStorage\u003c/code\u003e limit using the same stale usage value, all passing simultaneously.\u003c/li\u003e\n\u003cli\u003eEach request proceeds to the \u003ccode\u003einventory.CommitWithStorageDiff\u003c/code\u003e stage, where the total requested size is added to the user's \u003ccode\u003estorage\u003c/code\u003e column in the database.\u003c/li\u003e\n\u003cli\u003eThe sum of all concurrent reservations exceeds the configured \u003ccode\u003eMaxStorage\u003c/code\u003e quota.\u003c/li\u003e\n\u003cli\u003eAttacker completes the chunked uploads for all sessions, writing excess data to the physical disk.\u003c/li\u003e\n\u003cli\u003eHost disk space is exhausted, causing a denial of service for all users on the instance.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows any authenticated user to ignore storage limitations, leading to unauthorized resource consumption and potential denial of service. By filling the host server's storage partition, an attacker can prevent all users from uploading files or accessing services, causing total availability loss for the Cloudreve instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for administrators:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Cloudreve to version 4.0.0-20260715025621-7329602751c0 or later to patch CVE-2026-77633.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual spikes in rapid, concurrent \u003ccode\u003ePrepareUpload\u003c/code\u003e requests originating from a single user session.\u003c/li\u003e\n\u003cli\u003eImplement external storage monitoring to alert on rapid decreases in host filesystem availability, which may indicate storage-based DoS exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-23T01:54:44Z","date_published":"2026-09-23T01:54:44Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cloudreve-quota-bypass/","summary":"Cloudreve v4 contains a Time-of-Check to Time-of-Use (TOCTOU) vulnerability that allows authenticated users to bypass storage quotas and exhaust host disk space by triggering concurrent, non-atomic upload session reservations.","title":"Cloudreve Storage Quota Bypass via TOCTOU Race Condition","url":"https://feed.craftedsignal.io/briefs/2026-09-cloudreve-quota-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cloudreve (V4 \u003c 4.0.0-20260715025621-7329602751c0)","version":"https://jsonfeed.org/version/1.1"}