{"id":"GO-2026-6578","revision":null,"records":[{"revision":"c963c485678142ecafc1785f3f0f0847","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-77633","aliases":[],"title":"Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service","description":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0.","state":0,"publishedAt":"2026-09-22T15:28:56.7+00:00","modifiedAt":"2026-09-25T23:38:53.232+00:00","affected":[{"ecosystem":"Vendor product","name":"cloudreve","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"cloudreve\",\n                    \"product\": \"cloudreve\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.18.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","score":7.1,"severity":"HIGH"}],"references":["https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj","https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df","https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-77633","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-77633","identifiers":["CVE-2026-77633"]},"retained":false,"historicalAffected":[]},{"revision":"a9e1559ff42a46eeb762bfc08e92e142","observedAt":"2026-11-11T16:09:10.902+00:00","statement":{"source":"euvd","id":"EUVD-2026-84528","aliases":["CVE-2026-77633","GHSA-xj3h-wwxq-gfcj"],"title":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional s…","description":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","score":7.1,"severity":null}],"references":["https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj","https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df","https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84528","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 22, 2026, 3:28:56 PM","dateUpdated":"Sep 25, 2026, 11:38:53 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-84528","identifiers":["EUVD-2026-84528","CVE-2026-77633","GHSA-xj3h-wwxq-gfcj"]},"retained":false,"historicalAffected":[]},{"revision":"bdb02fadee744ee585664eb2b85538d2","observedAt":"2026-10-25T16:19:04.694+00:00","statement":{"source":"nvd","id":"CVE-2026-77633","aliases":[],"title":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional s…","description":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0.","state":0,"publishedAt":"2026-09-22T16:17:55.817+00:00","modifiedAt":"2026-09-26T00:16:35.823+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","score":7.1,"severity":"HIGH"}],"references":["https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df","https://github.com/cloudreve/cloudreve/releases/tag/4.18.0","https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77633","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-362","CWE-367","CWE-770"],"productCriteria":[],"sourceDates":{"published":"2026-09-22T16:17:55.817","lastModified":"2026-09-26T00:16:35.823"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-77633","identifiers":["CVE-2026-77633"]},"retained":false,"historicalAffected":[]},{"revision":"8b42d1593d834389ad2a9002bb3bf9d0","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-xj3h-wwxq-gfcj","aliases":["CVE-2026-77633","GO-2026-6578"],"title":"Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service","description":"## Summary\n\nCloudreve v4 splits the storage-quota **check** (reading the user's `used` bytes and comparing them to `MaxStorage`) and the **charge** (incrementing `users.storage`) into two non-atomic steps in the `PrepareUpload` code path. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition. Any authenticated user — including an unprivileged account in the default `User` group — can concurrently issue several upload-session requests that all read the same stale `used` snapshot, each pass the check, and then each contribute their declared `size` to `users.storage`. The end result is that the total approved capacity exceeds the group's `MaxStorage` many times over.\n\nThe same primitive is trivially amplifiable into a storage-based denial of service. During `PrepareUpload`, Cloudreve reserves the declared size against `users.storage` before any bytes are written, so an attacker can push the reserved amount far beyond the host's physical disk (tested: a 1 GiB-quota account reserved 17 GiB in a single 20-way burst), and can then materialise the reservation by completing chunked uploads to actually write the excess bytes to disk. Amplification to the host's free space fills the disk and denies uploads for every user of the instance.\n\nExploitation requires only a valid session with `Files.Write` permission. No administrator configuration, no non-default storage policy, and no elevated privileges are needed. The default deployment (local storage policy, default `User` group) is affected.\n\n## Technical details\n\n`PrepareUpload` in `pkg/filemanager/fs/dbfs/upload.go` splits quota enforcement across two stages:\n\n**Stage A — the check (snapshot compare, no lock)** — `pkg/filemanager/fs/dbfs/validator.go`:\n\n```go\nfunc (f *DBFS) validateUserCapacity(ctx context.Context, size int64, u *ent.User) error {\n    capacity, err := f.Capacity(ctx, u)              // reads \"used\"\n    if err != nil { return ... }\n    return f.validateUserCapacityRaw(ctx, size, capacity)\n}\n\nfunc (f *DBFS) validateUserCapacityRaw(ctx context.Context, size int64, capacity *fs.Capacity) error {\n    if capacity.Used + size > capacity.Total {       // snapshot compare only; no lock, no reservation\n        return fs.ErrInsufficientCapacity\n    }\n    return nil\n}\n```\n\n`capacity.Used` comes from the in-memory `*ent.User` that was hydrated once at the beginning of the request — `pkg/filemanager/fs/dbfs/dbfs.go`:\n\n```go\nfunc (f *DBFS) Capacity(ctx context.Context, u *ent.User) (*fs.Capacity, error) {\n    ...\n    res.Used  = f.user.Storage            // captured at request start\n    res.Total = requesterGroup.MaxStorage\n    return res, nil\n}\n```\n\nNo SELECT is issued at check time, no row lock is taken on the user row, and pending upload sessions are not counted.\n\n**Stage B — the charge (single unconditional UPDATE, outside the tx)** — `pkg/filemanager/fs/dbfs/upload.go` → `inventory/tx.go` → `inventory/user.go`:\n\n```go\n// PrepareUpload: check (A) ...  then, many statements later ...\nif err := f.validateUserCapacity(ctx, req.Props.Size, ancestor.Owner()); err != nil {\n    return nil, err\n}\n...\nif err := inventory.CommitWithStorageDiff(ctx, dbTx, f.l, f.userClient); err != nil { ... }  // charge (B)\n\n// inventory/user.go\nc.client.User.Update().Where(user.ID(uid)).AddStorage(diff).Exec(ctx)  // SQL: storage = storage + diff\n```\n\nBetween A and B the code performs storage-policy load-balancing, save-path generation, encryption-metadata generation, transaction start, placeholder-file/entity creation, and metadata upsert. This leaves a wide race window. `N` concurrent `PrepareUpload` requests each read the same stale `Used` snapshot at A, each pass their independent quota check, and then each add their own `size` to `users.storage` at B. The committed total is up to `N × size` above `MaxStorage`.\n\nThree defensive controls that would each independently close the race are missing:\n\n1. The check and the charge are not enclosed in the same transaction with a `SELECT ... FOR UPDATE` on the user row.\n2. The charge is a plain `storage = storage + :size` UPDATE, not an atomic conditional update of the form `UPDATE users SET storage = storage + :size WHERE id = :uid AND storage + :size <= :max_storage`.\n3. `Used` is computed only from committed entities. Concurrent pending upload sessions (which have already been reserved by the accounting model) are not counted, so races among sessions that haven't yet completed are invisible to each other.","state":0,"publishedAt":"2026-09-22T20:40:33+00:00","modifiedAt":"2026-10-01T20:55:42.4891385+00:00","affected":[{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.0.0-20260715025621-7329602751c0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj","https://nvd.nist.gov/vuln/detail/CVE-2026-77633","https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df","https://github.com/cloudreve/cloudreve","https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"],"sourceUrl":"https://github.com/advisories/GHSA-xj3h-wwxq-gfcj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xj3h-wwxq-gfcj","identifiers":["GHSA-xj3h-wwxq-gfcj","CVE-2026-77633","GO-2026-6578"]},"retained":false,"historicalAffected":[]},{"revision":"a7e49828310349faa147ebeda42fa579","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6578","aliases":["CVE-2026-77633","GHSA-xj3h-wwxq-gfcj"],"title":"Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service in github.com/cloudreve/Cloudreve","description":"Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service in github.com/cloudreve/Cloudreve","state":0,"publishedAt":"2026-10-01T20:23:38+00:00","modifiedAt":"2026-10-01T20:45:15.8866256+00:00","affected":[{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.0.0-20260715025621-7329602751c0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj","https://nvd.nist.gov/vuln/detail/CVE-2026-77633","https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df","https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6578","license":"OSV · upstream source license applies","key":"osv:GO-2026-6578","identifiers":["GO-2026-6578","CVE-2026-77633","GHSA-xj3h-wwxq-gfcj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T20:58:42.4460032+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T20:58:42.4460032+00:00","lastSuccessAt":"2026-11-11T20:58:42.6009016+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.6009024+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-bc2564cf749a574ebe6216cd53b2772c98ccf01e107d9e465c7cb9637c59db40","complete":true,"records":424281,"lastAttemptAt":"2026-11-11T20:56:40.1262638+00:00","lastSuccessAt":"2026-11-11T19:56:47.8167322+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:56:40.1262638+00:00","snapshotPublishedAt":"2026-11-11T19:18:45+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cbeeeca22e4a4c188e95cc4f8cfc6560","complete":false,"records":13759,"lastAttemptAt":"2026-11-11T21:08:58.0161049+00:00","lastSuccessAt":"2026-11-11T21:08:58.011+00:00","error":"249 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T21:08:58.011+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13368,"expectedIdentifiers":13813,"failedIdentifiers":249},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T20:58:42.4460032+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T20:58:42.4460032+00:00","lastSuccessAt":"2026-11-11T20:58:42.6018487+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.6018491+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f58072f00ed84b8dbc554f4a4e66e21a","complete":true,"records":13753,"lastAttemptAt":"2026-11-11T20:59:01.4643428+00:00","lastSuccessAt":"2026-11-11T20:59:01.459+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:59:01.459+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T20:58:42.3041045+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.3041045+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T20:56:40.2809572+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:56:40.2809572+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T20:58:42.411286+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.411286+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-757d3692f9a7b34792dad960197f3cc953a54db59b7d0ffe3835a0ed9926f76b","complete":true,"records":231690,"lastAttemptAt":"2026-11-11T20:58:42.1683586+00:00","lastSuccessAt":"2026-11-11T20:58:40.6131056+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.1683586+00:00","snapshotPublishedAt":"2026-11-11T20:03:03+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}