Cloudreve WOPI PUT_RELATIVE Path Traversal Vulnerability Alert
An early warning has been issued regarding a potential path traversal vulnerability in Cloudreve's WOPI PUT_RELATIVE handler, which may allow arbitrary file creation in the owner's account.
What happened
Reportedly, Cloudreve's WOPI PUT_RELATIVE handler is under investigation for a path traversal vulnerability. This issue appears to allow an attacker to create arbitrary files within the owner's account by manipulating the X-WOPI-SuggestedTarget parameter. The handler treats this parameter as a path, potentially enabling the creation of files outside the intended directory. Professional software engineers using Cloudreve are advised to review their installations and update to a version where this vulnerability is patched. Additionally, ensure that file paths are properly validated and sanitized to mitigate potential risks. For more detailed information, consult the primary sources.
How 0Day mitigates this
cloudreve is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.