CVE-2026-54563: Path Traversal and Incorrect Authorization in Cloudreve WebDAV Component

The WebDAV interface within Cloudreve is designed to permit users to access their files via standard network-attached storage protocols. To restrict sub-users or specific API integrations, Cloudreve allows administrators to generate folder-scoped WebDAV credentials. These credentials represent logical boundaries configured to restrict transactions to a designated directory.

CVE-2026-54563 describes an authorization bypass and logical path traversal flaw in the URL handling mechanisms of this interface. Because the application logic fails to validate that resolved paths remain within the authorized root path, users with restricted folder credentials can access the entire logical file hierarchy of the account holder.

This vulnerability affects all releases of Cloudreve prior to version 4.16.1. Depending on the privilege scope of the credentials (read-only or read-write), an attacker can extract, modify, or delete administrative and personal files stored outside the configured directory.

The vulnerability stems from an architectural oversight in how WebDAV routing and file path construction interact in pkg/webdav/webdav.go. When an HTTP request is received by the application, Go's standard net/http package processes and normalizes URL-encoded characters in r.URL.Path before dispatching the request to the WebDAV handler. As a result, traversal components like %2e%2e are decoded into standard parent directory characters (..).

The application removes the initial routing prefix /dav using the stripPrefix utility to extract the logical target path suffix. This extracted suffix is joined directly with the user's base WebDAV directory path utilizing the base.JoinRaw(suffix) or fs.URI.JoinRaw(suffix) methodology.

The underlying library implementation of JoinRaw employs standard URI cleaning algorithms, such as url.URL.JoinPath. While this correctly formats and normalizes parent directories, resolving root/subfolder/../target to root/target, it completes the resolution without verifying whether the target remains structurally bounded by the root/subfolder hierarchy. Consequently, the directory hierarchy is escaped dynamically, resulting in an incorrect authorization state mapping to CWE-863.

The original implementation in pkg/webdav/webdav.go handled path concatenation and logical access mapping as follows:

// VULNERABLE CODE PATH (Pre-4.16.1)
func (fs *FS) ResolvePath(suffix string) (URI, error) {
    // Suffix is joined without verifying boundaries
    targetURI := fs.URI.JoinRaw(suffix)
    return targetURI, nil
}

Because the path resolving mechanism merely performs raw string manipulation and URI cleansing, input strings containing directory traversal components natively break out of the directory schema during logical joining.

The mitigation in version 4.16.1 resolves this flaw by ensuring that the resolved candidate URI is structurally verified against the configured base directory. The patch relies on verifying that the target path is a logical sub-node of the base directory before returning the URI context:

// PATCHED CODE PATH (4.16.1+)
func (fs *FS) ResolvePath(suffix string) (URI, error) {
    candidate := fs.URI.JoinRaw(suffix)
    
    // Verify candidate is within the expected directory boundary
    if !candidate.EqualOrIsDescendantOf(fs.BaseURI, "") {
        return URI{}, ErrForbidden
    }
    return candidate, nil
}

This validation ensures that any decoded traversal sequences that evaluate to paths outside the root directory are caught post-resolution, triggering a termination signal before any OS-level file system or database access attempts occur.

Exploitation of CVE-2026-54563 requires network access to the WebDAV endpoint and valid credentials for a scoped WebDAV subfolder. An attacker identifies target pathways by estimating directory depths relative to their designated root directory.

To retrieve a file outside the restricted folder, the attacker issues a standard WebDAV PROPFIND or GET request. The URL contains URL-encoded directory traversal symbols to bypass naive blocklists while forcing the internal router to normalize the path:

PROPFIND /dav/%2e%2e/target_document.pdf HTTP/1.1
Host: target-instance.local
Authorization: Basic dXNlcjpwYXNzd29yZA==

When the application processes this request, the prefix is stripped and %2e%2e resolves to ... The logical path resolves to /restricted_folder/../target_document.pdf, yielding /target_document.pdf after cleaning. If the credentials permit write permissions, the attacker can leverage PUT, DELETE, or MOVE methods to overwrite, delete, or relocate files anywhere within the broader logical directory scope of the main account holder.

The following architecture diagram represents the request flow and shows where the security check fails in vulnerable versions versus where it is caught in patched instances:

In older installations, the absence of the containment check meant that the control flow progressed directly from path resolution to logical file system access.

The impact of CVE-2026-54563 is classified as High. The capability is scoped to unauthorized data access and modification within the Cloudreve application sandbox. Since WebDAV permissions correspond to logical file paths, access does not bypass container boundaries or operating system sandboxes unless systemic local integration issues exist.

Within the Cloudreve application, the confidentiality risk is high. Scoped WebDAV users can read sensitive documents, configurations, and assets belonging to parent accounts. If the scoped credentials carry write permissions, integrity is compromised as attackers can rewrite data blocks, rendering storage structures untrusted.

The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. However, because WebDAV integrations are commonly automated, exposure exposes cloud storage nodes to risk if restricted credentials are split among third-party clients.