Medium severity4.3NVD Advisory· Published Jul 31, 2026· Updated Sep 8, 2026
CVE-2026-55499
CVE-2026-55499
Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/cloudreve/Cloudreve/v4Go | < 4.0.0-20260613030215-0b00dd308f13 | 4.0.0-20260613030215-0b00dd308f13 |
github.com/cloudreve/Cloudreve/v3Go | <= 3.0.0-20250225100611-da4e44b77af4 | — |
Affected products
2- osv-coordsRange: < 0.0.20260827T195228-160000.1.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.