Technical impact
The vulnerability arises from Cloudreve's thumbnail and avatar image decoders, which enforce limits on the compressed file size but neglect to bound the dimensions of the decoded image. An attacker who can authenticate to a Cloudreve instance can submit a modestly sized PNG, JPEG or GIF that, when decompressed, requires an unbounded allocation of memory. The resulting out‑of‑memory condition causes the Cloudreve process to terminate with a fatal error, leading to a denial of service for all users.
Affected Systems
Any self‑hosted Cloudreve installation running a version prior to 4.17.0 is affected. The flaw is present in the cloudreve:cloudreve repository and affects all thumbnail and avatar decoding functionality. Systems that have already applied the 4.17.0 release are not vulnerable. The vulnerability can be triggered by any authenticated user capable of uploading images.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate severity, and the EPSS score is < 1%, indicating a very low exploitation probability, while the lack of a KEV listing suggests the vulnerability is not yet widely exploited. Exploitation requires authenticated access to Cloudreve and the ability to upload images, a capability typically granted to regular users. An attacker can simply submit a specially crafted image, provoking an unbounded allocation that crashes the process. Because the crash affects availability rather than confidentiality or integrity, the primary impact is DoS; the host may experience temporary memory pressure before the process dies.
Github GHSA