Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cloudreve | cloudreve | < 4.17.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | openSUSE-SU-2026:21761-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cloudreve/Cloudreve | all versions | — | GO-2026-6102 |
| Go | github.com/cloudreve/Cloudreve/v3 | <= 3.0.0-20250225100611-da4e44b77af4 | — | GHSA-w8x7-h2px-xmq8 |
| Go | github.com/cloudreve/Cloudreve/v3 | all versions | — | GO-2026-6102 |
| Go | github.com/cloudreve/Cloudreve/v4 | < 4.0.0-20260613030215-0b00dd308f13 | 4.0.0-20260613030215-0b00dd308f13 | GHSA-w8x7-h2px-xmq8 |
Advisories 2
- SUSE-SU-2026:23625-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
- openSUSE-SU-2026:21761-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 9, 2026