CyberRota Analysis
AI-GeneratedCloudreve versions prior to 4.17.0 are vulnerable due to inadequate limits on decoded pixel dimensions in their image decoders, which can lead to unbounded memory allocation and cause the application to crash. This vulnerability primarily affects authenticated users who can exploit the flaw by submitting specially crafted image files. Organizations using Cloudreve for file management should prioritize upgrading to version 4.17.0 to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to submit a small PNG, JPEG, or GIF that triggers an unbounded allocation and terminates the Cloudreve process through fatal out-of-memory behavior. This issue is fixed in version 4.17.0.