THREAT OPS › Threat News › [GHSA] GHSA-w5fv-7x5q-g8qp (high) — Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root
[GHSA] GHSA-w5fv-7x5q-g8qp (high) — Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root
GHSA-w5fv-7x5q-g8qp Severity: high CVE: CVE-2026-54563
Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root
## Summary
A Cloudreve WebDAV account stores a `uri` that defines the account's root folder. The WebDAV request handler (`stripPrefix` in `pkg/webdav/webdav.go`) trims the `/dav` prefix from the request path and j
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-54563cve
- https://cloudreve.example/dav/%2e%2e/outside.txturl
- https://cloudreve.example/dav/%2e%2e/url
- https://cloudreve.example/dav/%2e%2e/created-outside.txturl
- https://host/dav/%2e%2e/outside.txt`url
Original source: https://github.com/advisories/GHSA-w5fv-7x5q-g8qp