A WOPI integration that is only expected to view a user's file can modify that file through the WOPI write endpoints. If the WOPI URL or session id leak...
id: GO-ID-PENDING
modules:
- module: github.com/cloudreve/Cloudreve
vulnerable_at: 0.0.0-20201026073328-746aa3e8ef26
- module: github.com/cloudreve/Cloudreve/v3
vulnerable_at: 3.0.0-20250225100611-da4e44b77af4
- module: github.com/cloudreve/Cloudreve/v4
versions:
- fixed: 4.0.0-20260626022433-f3347130ac48
summary: |-
Cloudreve WOPI view sessions can write files and WOPI access token secret is
ignored in github.com/cloudreve/Cloudreve
cves:
- CVE-2026-62323
ghsas:
- GHSA-c3jm-gv5r-9wcp
references:
- advisory: https://github.com/advisories/GHSA-c3jm-gv5r-9wcp
- advisory: https://github.com/cloudreve/cloudreve/security/advisories/GHSA-c3jm-gv5r-9wcp
- fix: https://github.com/cloudreve/cloudreve/commit/f3347130ac48f2ff996af9ef66c97be2dda9cba9
notes:
- fix: 'github.com/cloudreve/Cloudreve/v4: could not add vulnerable_at: could not find tagged version between introduced and fixed'
source:
id: GHSA-c3jm-gv5r-9wcp
created: 2026-07-24T22:02:09.509275464Z
review_status: UNREVIEWED
Advisory GHSA-c3jm-gv5r-9wcp references a vulnerability in the following Go modules:
Description:
Summary
Cloudreve WOPI access tokens are generated as
<session-id>.<random-secret>, but the WOPI middleware validates only the session id prefix and never compares the supplied token to the stored token. In addition, a WOPI viewer session does not store or enforce the requested viewer action. A session created for a view or preview action can still call WOPI write routes if the underlying file is writable by the session user.Impact
A WOPI integration that is only expected to view a user's file can modify that file through the WOPI write endpoints. If the WOPI URL or session id leak...
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.