{"id":"CVE-2026-45727","aliases":["GHSA-mf33-gv72-w2h5","PYSEC-2026-2420"],"title":"CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion","summary":"CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion","severity":"high","vendor":"cloakbrowser","product":"cloakbrowser","ecosystem":"pip","affected":["cloakbrowser < 0.3.28"],"patched":["cloakbrowser 0.3.28"],"published":"2026-05-18","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-mf33-gv72-w2h5","references":[{"url":"https://github.com/CloakHQ/CloakBrowser/security/advisories/GHSA-mf33-gv72-w2h5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45727"},{"url":"https://github.com/CloakHQ/CloakBrowser"}],"tags":["osv","pip"],"epss":0.00475,"epssPercentile":0.40262,"ingestedAt":"2026-07-13T18:58:00.606Z","slug":"CVE-2026-45727","body":"## Overview\n\nThe `cloakserve` CDP multiplexer uses the user-supplied `fingerprint` query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted `fingerprint` value containing path traversal sequences to resolve `user_data_dir` outside the configured `data_dir`. When Chrome fails to start or the process is cleaned up, `shutil.rmtree()` deletes the traversed path, resulting in arbitrary directory deletion.\n\nAdditionally, `cloakserve` bound to `0.0.0.0` by default, making it network-exposed.\n\n### Impact\n\nAn attacker with network access to the cloakserve port can delete arbitrary directories accessible to the service user.\n\n### Patches\n\nFixed in v0.3.28.\n\n### Mitigations\n\n- Upgrade to v0.3.28 or later\n- Restrict network access to the cloakserve port\n\n## Affected packages\n\n- `cloakbrowser < 0.3.28`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `cloakbrowser 0.3.28`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}