| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/HFO4/cloudreve | ≥ 1.0.0, ≤ 2.0.0 | |
| github.com/cloudreve/Cloudreve/v3 | ≥ 3.0.0, < 3.6.0-beta1 | 3.6.0-beta1 |
| cloudreve | ≥ 1.0.0, ≤ 3.5.3 |
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free