The Cloudreve file‑management system contains a time‑of‑check to time‑of‑use race condition in its upload preparation routine. An authenticated user with write permission can launch multiple concurrent upload sessions; each session reads the same stale in‑memory quota snapshot before the database transaction that reserves storage is completed. The race allows all sessions to pass the maximum storage check and subsequently reserve space, causing the total reserved amount to exceed the user’s quota. The excess reservations can be materialized as real storage usage, exhausting host disk space and preventing other users from uploading data, effectively denying service. This flaw aligns with CWE‑362, CWE‑367, and CWE‑770 weaknesses.

All installations of Cloudreve running a version earlier than 4.18.0 are affected. The vulnerability impacts the default local‑storage policy and the default User group, which means typical deployments are vulnerable unless the user group configuration is customized.

The CVSS score of 7.1 indicates a high severity, though the EPSS score is not available. The flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation thus far. The attack requires the attacker to be a legitimate user with Files.Write permission and to submit several simultaneous upload requests, which limits the obvious threat surface. Nonetheless, a persistent attacker who can achieve concurrent uploads can quickly exhaust storage on the host and disrupt service for all users.