CVE-2026-77633

Cloudreve , a self-hosted file management and sharing system, contains a TOCTOU race condition in PrepareUpload (pkg/filemanager/fs/dbfs/upload.go) prior to version 4.18.0. The function checks a stale in-memory storage value via validateUserCapacity, then applies an unconditional storage charge o...