Go/github.com/cloudreve/Cloudreve/v4 CVE-2026-101048: medium 5.4, EPSS 0.19%

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

Action: Upgrade github.com/cloudreve/Cloudreve/v4 to 4.0.0-20260626022735-332a9d800205 or later.

go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260626022735-332a9d800205

Affected

Fixed versions

Sources

• osv: GHSA-v6w6-358x-2433
• https://github.com/cloudreve/cloudreve/security/advisories/GHSA-v6w6-358x-2433
• https://github.com/cloudreve/cloudreve/commit/332a9d800205082a2469e555fd66a63f18d9d5dc
• https://github.com/cloudreve/cloudreve
• https://github.com/cloudreve/cloudreve/releases/tag/4.17.0

CVE-2026-101048 · published 2026-07-24T21:50:23Z · modified 2026-09-28T03:55:28.333068843Z · JSON