The vulnerability is a path traversal flaw in the Cloudreve WOPI PUT_RELATIVE handler, where the X-WOPI-SuggestedTarget header is improperly treated as a path rather than a file name. This allows an attacker to supply slash or dot-dot segments that escape the intended directory and create or overwrite files elsewhere in the same owner account. If an attacker can supply such a request, they could place arbitrary executables or malicious scripts in the victim’s account, potentially compromising data integrity and availability.

The affected product is the Cloudreve self‑hosted file management and sharing system, versions earlier than 4.17.0. All releases before the 4.17.0 milestone are vulnerable, including 4.16.x and older.

The CVSS score is 4.3, indicating a moderate level of severity. The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog. The flaw is exploitable through simple HTTP requests to the WOPI PUT_RELATIVE endpoint, using crafted X-WOPI‑SuggestedTarget values to perform directory traversal. Successful exploitation would allow an authenticated account holder to create or overwrite files within their own storage space. The overall risk is moderate; however, because the vulnerability affects only authenticated users, the attack surface is limited compared to public‑reached exploits.