Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cloudreve/Cloudreve/v4 | go | < 4.0.0-20260613030215-0b00dd308f13 | 4.0.0-20260613030215-0b00dd308f13 |
| github.com/cloudreve/Cloudreve/v3 | go | <= 3.0.0-20250225100611-da4e44b77af4 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the handling of server-sent events (SSE) for single-file shares in Cloudreve. The core issue is a broken access control mechanism that allows a recipient of a single shared file to receive metadata about other files and folders in the same parent directory as the shared file.
The analysis started by examining the provided patch, which clearly modifies the HandleExplorerEventsPush function in service/explorer/events.go. This function is the entry point for the vulnerable API endpoint /api/v4/file/events. The patch mitigates the vulnerability by adding a check to prohibit event subscriptions on single-file shares. This makes HandleExplorerEventsPush a key function that would appear in a runtime profile during exploitation.
The detailed vulnerability description provides a deep dive into the root cause, which involves a chain of function calls. The manager.Manager.List function, when called for a single-file share, incorrectly resolves the path to the parent directory. This is due to the logic in shareNavigator.Root and shareNavigator.To in pkg/filesystem/navigator/share_navigator.go, which swaps the share root to the owner's parent folder. Finally, the DBFS.getEligibleSubscriber function in pkg/filesystem/fs.go broadcasts events to all subscribers of an ancestor folder without checking if the subscriber is actually authorized to view the specific file that changed.
Therefore, while the patch is in HandleExplorerEventsPush, a full understanding of the vulnerability requires considering the entire chain of functions that contribute to the information leak. All these functions would likely be present in a stack trace when the vulnerability is triggered.
explorer.ExplorerEventService.HandleExplorerEventsPushservice/explorer/events.go
manager.Manager.Listpkg/fs/manager.go
shareNavigator.Rootpkg/filesystem/navigator/share_navigator.go
shareNavigator.Topkg/filesystem/navigator/share_navigator.go
DBFS.getEligibleSubscriberpkg/filesystem/fs.go