GHSA-49H3-CWHJ-4737 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Summary Cloudreve's WOPI PUTRELATIVE handler treats X-WOPI-SuggestedTarget as a path, not a filename. It splits the header on / and joins the segments onto the source file's directory with URI.JoinRaw, which feeds Go's url.JoinPath. url.JoinPath resolves ./.. segments, so a slash-bearing target...

PT-2026-64431

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description The WOPI PUT RELATIVE handler incorrectly processes the X-WOPI-SuggestedTarget variable by passing it to URI.JoinRaw as a path instead of a filename. This allows the use of slash and dot-dot...