CVE-2026-55497

Summary (CVE-2026-55497): Cloudreve before 4.17.0 is vulnerable to an unbounded memory allocation during image decoding. The built‑in thumbnail and avatar decoders only cap the compressed file size; they do not limit decoded pixel dimensions for PNG/JPEG/GIF, enabling an authenticated user to sub...