CVE-2026-77633

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77633
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77633.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77633
Aliases
Published
2026-09-22T15:28:56Z
Modified
2026-09-24T03:46:17Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
Summary
Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service
Details

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-362",
        "CWE-367",
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77633.json"
}
References

Affected packages

Git / github.com/cloudreve/cloudreve

Affected ranges

Type
GIT
Repo
https://github.com/cloudreve/cloudreve
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7329602751c00bb4136fe9ad8b364d0df70773df
Fixed
0bb0ab833571d380153edd3529e01a7957b8b4ce
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "4.18.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.0.0
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-rc1
3.1.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.3.2
3.4.0
3.4.0-beta1
3.4.1
3.4.2
3.5.0
3.5.0-beta.3
3.5.0-beta1
3.5.0-beta2
3.5.1
3.5.2
3.5.3
3.6.0
3.6.0-beta1
3.6.1
3.6.2
3.7.0
3.7.1
3.8.0
3.8.0-beta1
3.8.1
3.8.2
3.8.3
4.*
4.0.0
4.0.0-beta.10
4.0.0-beta.11
4.0.0-beta.12
4.0.0-beta.13
4.0.0-beta.14
4.0.0-beta.6
4.0.0-beta.7
4.0.0-beta.8
4.0.0-beta.9
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.1
4.11.0
4.11.1
4.12.0
4.12.1
4.13.0
4.14.0
4.14.1
4.15.0
4.16.0
4.16.1
4.17.0
4.2.0
4.3.0
4.4.0
4.4.1
4.5.0
4.5.1
4.6.0
4.7.0
4.8.0
4.9.0
4.9.1
4.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77633.json"