Low severity3.1NVD Advisory· Published Sep 27, 2026· Updated Sep 27, 2026

CVE-2026-101051

Description

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations within accessible namespaces.

Affected products

Cloudreve/Cloudrevellm-fuzzy
Range: <4.16.1

Patches

Vulnerability mechanics

References

github.com/cloudreve/cloudreve/security/advisories/GHSA-w8j7-39hp-8x59nvd
www.vulncheck.com/advisories/cloudreve-before-4.16.1-path-traversal-via-remote-downloadnvd

News mentions

No linked articles in our index yet.

cvss	0.202
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000