CVE-2026-45727

CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

View on CVE.org

Published Jun 1, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

CloakBrowser is a tool to bypass bot detection tests. Prior to version 0.3.28, the cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted fingerprint value containing path traversal sequences to resolve user_data_dir outside the configured data_dir. When Chrome fails to start or the process is cleaned up, shutil.rmtree() deletes the traversed path, resulting in arbitrary directory deletion. Additionally, cloakserve bound to 0.0.0.0 by default, making it network-exposed. This issue has been patched in version 0.3.28.

Analysis

Technical impact

CloakBrowser’s cloakserve CDP multiplexer incorrectly uses the user-supplied fingerprint query parameter as a directly concatenated filesystem path component when creating Chrome profile directories. The vulnerability is a classic directory traversal flaw, classified as CWE‑22, that allows an unauthenticated attacker to supply a crafted fingerprint value containing traversal sequences. When Chrome fails to launch or the process is cleaned up, the cleanup routine uses shutil.rmtree() to remove the profile directory, which deletes the resolved traversed path. Consequently, an attacker can delete any directory located outside the intended data directory, causing data loss and potentially disrupting system operation. This flaw does not provide code execution but can lead to significant integrity and availability damage.

Affected Systems

The flaw exists in CloakHQ CloakBrowser versions prior to 0.3.28. The service, cloakserve, binds to 0.0.0.0 by default, making it accessible over the network. An unauthenticated client can reach the cloakserve port and trigger the directory deletion by sending the malicious fingerprint parameter. Users running older CloakBrowser instances without network restriction are directly exposed to this threat.

Risk and Exploitability

The CVSS score of 8.8 reflects a high‑severity impact. EPSS is not available, but the lack of authentication and the service’s global binding increase the likelihood of exploitation. The flaw is not listed in CISA KEV, but it can be proactively mitigated by upgrading to version 0.3.28. Attackers would send a specially crafted fingerprint value over the cloakserve port to trigger arbitrary directory deletion.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

CloakHQ

CloakBrowser

affected

Version	Status	Constraints
`< 0.3.28`	affected	—

No data.

Vendor Product Versions

Cloakhq

Cloakbrowser

Version	Status	Scheme	Platform
`[0,0.3.28)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor patch by upgrading CloakBrowser to version 0.3.28 or later, which removes the vulnerable handling of the fingerprint parameter.
Configure cloakserve to bind only to localhost or enforce firewall rules to block external access, thereby preventing unauthenticated network connections.
Validate and sanitize the fingerprint query parameter before it is used as a path component, ensuring it contains no traversal sequences or unsafe characters.

Generated by OpenCVE AI on June 1, 2026 at 21:05 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-mf33-gv72-w2h5	CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.475% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/CloakHQ/CloakBrowser/security/advisories/GHSA-mf33-gv72-w2h5

History

Jun 3, 2026 2:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cloakhq Cloakhq cloakbrowser
Vendors & Products		Cloakhq Cloakhq cloakbrowser

Jun 1, 2026 10:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 1, 2026 7:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		CloakBrowser is a tool to bypass bot detection tests. Prior to version 0.3.28, the cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted fingerprint value containing path traversal sequences to resolve user_data_dir outside the configured data_dir. When Chrome fails to start or the process is cleaned up, shutil.rmtree() deletes the traversed path, resulting in arbitrary directory deletion. Additionally, cloakserve bound to 0.0.0.0 by default, making it network-exposed. This issue has been patched in version 0.3.28.
Title		CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion
Weaknesses		CWE-22
References		https://github.com/CloakHQ/CloakBrowser/security/advisories/GHSA-mf33-gv72-w2h5
Metrics		cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}`