{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-54563/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-54563"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cloudreve v3","Cloudreve v4"],"_cs_severities":["high"],"_cs_tags":["path-traversal","webdav","cve-2026-54563"],"_cs_type":"advisory","_cs_vendors":["Cloudreve"],"content_html":"\u003cp\u003eCloudreve, a self-hosted file management and storage system, contains a critical path traversal vulnerability (CVE-2026-54563) in its WebDAV request handler. The issue stems from the \u003ccode\u003estripPrefix\u003c/code\u003e function in \u003ccode\u003epkg/webdav/webdav.go\u003c/code\u003e, which improperly sanitizes user-supplied paths before joining them to a defined account root. Because the application logic fails to validate that the final resolved path resides within the authorized account directory, attackers can leverage URL-encoded dot-dot sequences (e.g., \u003ccode\u003e%2e%2e\u003c/code\u003e) to traverse outside the intended folder boundaries.\u003c/p\u003e\n\u003cp\u003eThis vulnerability specifically impacts the per-folder WebDAV-account isolation, which is intended to provide limited access to third-party sync clients. While the traversal does not permit cross-user file access or direct OS filesystem escalation, it allows an authenticated user to perform read, list, create, overwrite, move, or delete operations on any file within the parent user's entire namespace. The vulnerability affects both Cloudreve v3 and v4 branches.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains a scoped WebDAV credential for a specific folder within a Cloudreve instance.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a WebDAV request (e.g., GET, PROPFIND, or PUT) targeting the \u003ccode\u003e/dav\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker injects URL-encoded traversal sequences (\u003ccode\u003e%2e%2e\u003c/code\u003e) into the request path.\u003c/li\u003e\n\u003cli\u003eThe WebDAV server receives the request and the \u003ccode\u003enet/http\u003c/code\u003e package decodes the traversal sequences into literal \u003ccode\u003e..\u003c/code\u003e segments.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003estripPrefix\u003c/code\u003e function in the Cloudreve handler joins the malicious path to the base URI without performing a containment check.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efs.URI.JoinRaw\u003c/code\u003e and standard library \u003ccode\u003eurl.URL.JoinPath\u003c/code\u003e functions resolve the \u003ccode\u003e..\u003c/code\u003e segments, escaping the intended account root.\u003c/li\u003e\n\u003cli\u003eThe application executes the requested file operation (read, write, or list) against the escaped directory path within the victim's namespace.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized access to data outside the scope of the assigned WebDAV account. An attacker with read-only credentials can list and read any file within the entire user namespace, while a writable credential allows for the modification, deletion, or creation of arbitrary files in those directories. This compromises the isolation mechanism of scoped DAV accounts, effectively elevating an account's privileges to the full scope of the parent user's storage.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of Cloudreve (v4.0.0-20260606032813-26b6b1044b02 or later for v4; versions \u0026gt; 3.0.0-20250225100611-da4e44b77af4 for v3) to address CVE-2026-54563.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) rule to block requests containing percent-encoded traversal sequences like \u003ccode\u003e%2e%2e\u003c/code\u003e or \u003ccode\u003e%2f..%2f\u003c/code\u003e targeting the \u003ccode\u003e/dav\u003c/code\u003e path.\u003c/li\u003e\n\u003cli\u003eAudit WebDAV account permissions and rotate credentials for any accounts that may have been accessible to untrusted third parties.\u003c/li\u003e\n\u003cli\u003eEnable detailed access logging on the Cloudreve webserver to monitor for suspicious \u003ccode\u003ePROPFIND\u003c/code\u003e or \u003ccode\u003ePUT\u003c/code\u003e requests containing traversal patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-26T20:21:15Z","date_published":"2026-08-26T20:21:15Z","id":"https://feed.craftedsignal.io/briefs/2026-08-cloudreve-dav-traversal/","summary":"A path traversal vulnerability in Cloudreve's WebDAV handler allows attackers with scoped credentials to escape their designated folder and perform unauthorized operations across the entire user namespace.","title":"Cloudreve WebDAV Path Traversal Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-08-cloudreve-dav-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-54563","version":"https://jsonfeed.org/version/1.1"}