GHSA-w8j7-39hp-8x59: Cloudreve's remote download file paths can escape the selected destination directory

August 24, 2026

Cloudreve trusts file paths returned by the configured remote downloader. A downloader-reported path such as ../../escaped.txt can cause a downloaded file to be created outside the user-selected destination directory.

References

github.com/advisories/GHSA-w8j7-39hp-8x59
github.com/cloudreve/cloudreve/security/advisories/GHSA-w8j7-39hp-8x59

Code Behaviors & Features

Detect and mitigate GHSA-w8j7-39hp-8x59 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →