{"id":"CVE-2026-55497","title":"Cloudreve is a self-hosted file management and sharing system","summary":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to subm…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400","CWE-409","CWE-770"],"vendor":"cloudreve","product":"github.com/cloudreve/Cloudreve/v4","affected":["github.com/cloudreve/Cloudreve/v4 < 4.0.0-20260613024411-3607f79bb44c","github.com/cloudreve/Cloudreve/v3 <= 3.0.0-20250225100611-da4e44b77af4"],"patched":["github.com/cloudreve/Cloudreve/v4 4.0.0-20260613024411-3607f79bb44c"],"published":"2026-07-31","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:51:43.490","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55497","references":[{"url":"https://github.com/cloudreve/cloudreve/commit/3607f79bb44c35d0be4fa8b6e24c0502b51415a9","label":"security-advisories@github.com"},{"url":"https://github.com/cloudreve/cloudreve/releases/tag/4.17.0","label":"security-advisories@github.com"},{"url":"https://github.com/cloudreve/cloudreve/security/advisories/GHSA-g9j2-8w95-3vwv","label":"security-advisories@github.com"},{"url":"https://github.com/cloudreve/cloudreve/security/advisories/GHSA-g9j2-8w95-3vwv","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-g9j2-8w95-3vwv"}],"tags":["nvd","ghsa","go"],"epss":0.0053,"epssPercentile":0.4234,"aliases":["GHSA-g9j2-8w95-3vwv"],"ecosystem":"go","ingestedAt":"2026-07-24T21:39:14.929Z","slug":"CVE-2026-55497","body":"## Overview\n\nCloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to submit a small PNG, JPEG, or GIF that triggers an unbounded allocation and terminates the Cloudreve process through fatal out-of-memory behavior. This issue is fixed in version 4.17.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55497)\n\nAffected packages:\n\n- `github.com/cloudreve/Cloudreve/v4 < 4.0.0-20260613024411-3607f79bb44c`\n- `github.com/cloudreve/Cloudreve/v3 <= 3.0.0-20250225100611-da4e44b77af4`\n\nPatched in:\n\n- `github.com/cloudreve/Cloudreve/v4 4.0.0-20260613024411-3607f79bb44c`\n\nSource: https://github.com/advisories/GHSA-g9j2-8w95-3vwv","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}