Cloudreve applications before version 4.16.1 allow authenticated users to construct download URLs that include path traversal characters. The remote downloader does not sanitize the file path it receives, so an attacker can force the server to write a file to any location within the namespace that the Web application can access. The ability to place a file arbitrarily can be used to overwrite existing files, plant malicious scripts, or store data in hidden locations. The vulnerability does not provide direct code execution but can facilitate subsequent attacks by exploiting file-system access.

All installations of Cloudreve where the version is older than 4.16.1 are affected. The product is identified as Cloudreve Cloudreve. No additional vendor or product variations are listed.

The CVSS v3 score is 2.3, which classifies the vulnerability as low severity. Exploitation requires an authenticated user with permission to trigger a remote download; it is not publicly exploitable. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. Because the impact is limited to arbitrary file writes, the risk is moderate but mitigated by the low severity and the requirement for authenticated access. Prompt patching is still recommended to prevent potential abuse.