CVE-2026-62323: Cloudreve

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token suffix and invoke WOPI write routes for the underlying file. This issue is fixed in version 4.17.0.

Affected products

• Cloudreve Cloudreve: before 4.17.0 (fixed in 4.17.0)

Published 2026-07-31. Last modified 2026-09-08.