CyberRota Analysis
AI-GeneratedCloudreve versions prior to 4.17.0 are vulnerable due to an event-stream subscription flaw that allows authenticated share recipients to access metadata of unshared sibling files and folders within the owner's parent directory. This could lead to unauthorized information disclosure, potentially exposing sensitive data. Organizations using affected versions should prioritize upgrading to 4.17.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.