CVE-2026-101051

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-101051
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101051.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-101051
Aliases
Published
2026-09-27T17:02:37Z
Modified
2026-09-29T03:45:57Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Cloudreve before 4.16.1 Path Traversal via Remote Download
Details

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations within accessible namespaces.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101051.json"
}
References

Affected packages

Git / github.com/cloudreve/cloudreve

Affected ranges

Type
GIT
Repo
https://github.com/cloudreve/cloudreve
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
26b6b1044b0253c5ead7d5a90eaa10ff67ac2582
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "4.16.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

3.*
3.0.0
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-rc1
3.1.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.3.2
3.4.0
3.4.0-beta1
3.4.1
3.4.2
3.5.0
3.5.0-beta.3
3.5.0-beta1
3.5.0-beta2
3.5.1
3.5.2
3.5.3
3.6.0
3.6.0-beta1
3.6.1
3.6.2
3.7.0
3.7.1
3.8.0
3.8.0-beta1
3.8.1
3.8.2
3.8.3
4.*
4.0.0
4.0.0-beta.10
4.0.0-beta.11
4.0.0-beta.12
4.0.0-beta.13
4.0.0-beta.14
4.0.0-beta.6
4.0.0-beta.7
4.0.0-beta.8
4.0.0-beta.9
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.1
4.11.0
4.11.1
4.12.0
4.12.1
4.13.0
4.14.0
4.14.1
4.15.0
4.16.0
4.2.0
4.3.0
4.4.0
4.4.1
4.5.0
4.5.1
4.6.0
4.7.0
4.8.0
4.9.0
4.9.1
4.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101051.json"