CyberRota Analysis
AI-GeneratedCloudreve versions prior to 4.16.1 are vulnerable due to improper sanitization of file paths in remote downloaders, enabling authenticated users to exploit path traversal sequences and create files outside designated directories. This could lead to unauthorized file creation in accessible namespaces, potentially compromising the integrity of the system. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations within accessible namespaces.