GHSA-W8J7-39HP-8X59: Path Traversal Vulnerability in Cloudreve Remote Downloader Workflow

Vulnerability ID: GHSA-W8J7-39HP-8X59
CVSS Score: 5.5
Published: 2026-08-24

A path traversal vulnerability exists in Cloudreve's remote download workflow, where improper sanitization of file paths returned by configured remote downloaders (such as aria2) allows authenticated users to write files outside the designated target folder.

TL;DR

Authenticated users can write files outside target directories by exploiting missing path-traversal validation in Cloudreve's integration with remote downloaders like aria2.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-22
• Attack Vector: Network
• CVSS v4.0: 5.5
• Exploit Status: PoC Available
• Impact: Partial Integrity (Unintended File Placement)
• Privileges Required: Authenticated User

Affected Systems

• Cloudreve
• Cloudreve: <= 4.0.0-20260606032813-26b6b1044b02 (Fixed in: None)

Exploit Details

• GitHub Security Advisory: Python mockup representing the malicious aria2 RPC server demonstrating the traversal sequence injection.

Mitigation Strategies

• Disable remote downloader configurations if not strictly needed
• Restrict remote download capabilities to trusted administrators
• Implement strict endpoint access controls for the aria2 JSON-RPC interface

Remediation Steps:

1. Audit configured remote download servers in the Cloudreve administration panel
2. Ensure aria2 RPC credentials are secure and not publicly exposed
3. Apply source-level patches to pkg/filemanager/workflows/remote_download.go to validate filenames
4. Recompile Cloudreve from the patched source code tree

References

• GitHub Security Advisory Details
• Cloudreve Security Advisory

Read the full report for GHSA-W8J7-39HP-8X59 on our website for more details including interactive diagrams and full exploit analysis.