CVE-2026-55497Medium· 6.5▾ SunlitCloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to subm…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to submit a small PNG, JPEG, or GIF that triggers an unbounded allocation and terminates the Cloudreve process through fatal out-of-memory behavior. This issue is fixed in version 4.17.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/cloudreve/Cloudreve/v4 < 4.0.0-20260613024411-3607f79bb44cgithub.com/cloudreve/Cloudreve/v3 <= 3.0.0-20250225100611-da4e44b77af4Patched in:
github.com/cloudreve/Cloudreve/v4 4.0.0-20260613024411-3607f79bb44cConnected by shared product, vendor, weakness, or advisory.
GHSA-v6w6-358x-2433Medium· 5.4Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests
CVE-2026-55495Medium· 4.3Cloudreve is a self-hosted file management and sharing system
CVE-2026-55496Medium· 4.3Cloudreve is a self-hosted file management and sharing system
CVE-2026-55499Medium· 4.3Cloudreve is a self-hosted file management and sharing system
CVE-2026-55502High· 7.1Cloudreve is a self-hosted file management and sharing system
CVE-2026-62323Medium· 6.3Cloudreve is a self-hosted file management and sharing system