Is github.com/cloudreve/Cloudreve safe ? github.com/cloudreve/Cloudreve (go) has 16 known vulnerabilities. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 31st percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-xj3h-wwxq-gfcj, the advisory selected below
// 16 advisories GHSA-xj3h-wwxq-gfcj Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service in github.com/cloudreve/Cloudreve UNKN GHSA-w89x-c962-c44g Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve UNKN GHSA-jvh5-97xg-v99f Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses in… UNKN GHSA-w5fv-7x5q-g8qp Cloudreve WebDAV (/dav) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root in github.com/cloudreve/Cloudreve UNKN GHSA-w8j7-39hp-8x59 Cloudreve's remote download file paths can escape the selected destination directory in github.com/cloudreve/Cloudreve UNKN GHSA-vx2m-jpxr-xv7w Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached contexthint in github.com/cloudreve/Cloudreve UNKN GHSA-v6w6-358x-2433 Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve UNKN GHSA-8r7f-r8hj-r3rv Cloudreve: Information Exposure in GET /api/v4/user/search: SearchActive omits the active-status predicate, leaking inactive/banned account emails in… UNKN GHSA-g9j2-8w95-3vwv Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server in github.com/cloudreve/Cloudreve UNKN GHSA-hq88-5x99-x3gf Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials in github.com/cloudreve/Cloudreve. UNKN Show all 16 advisories Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service in github.com/cloudreve/Cloudreve
Full advisory text at GitHub advisory , NVD or OSV .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability High // questions Is github.com/cloudreve/Cloudreve safe to install? CyberXYZ does not call a package safe in absolute terms. It records 16 known vulnerabilities for github.com/cloudreve/Cloudreve (go), and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/cloudreve/Cloudreve have known vulnerabilities? Yes. CyberXYZ records 16 known vulnerabilities for github.com/cloudreve/Cloudreve (go). These include GHSA-xj3h-wwxq-gfcj, GHSA-w89x-c962-c44g, GHSA-jvh5-97xg-v99f, GHSA-w5fv-7x5q-g8qp, GHSA-w8j7-39hp-8x59.
How do I check github.com/cloudreve/Cloudreve before installing? Search github.com/cloudreve/Cloudreve in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fcloudreve%2FCloudreve . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:46 UTC. The most recent advisory here was published 2026-10-01. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page