{"vulnerability": "cve-2026-77633", "sightings": [{"uuid": "743b1564-015b-4525-8b02-ba78b398ac95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77633", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mw5g5j7g3q24", "content": "Cloudreve v4 has CVE-2026-77633, a race in PrepareUpload that lets authenticated users bypass storage quotas and trigger storage-based denial of service. #software", "creation_timestamp": "2026-09-22T23:50:12.163945Z"}, {"uuid": "cb7ed765-79e1-47ad-88da-60855f3bd378", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77633", "type": "seen", "source": "https://gist.github.com/alon710/0f4409fbe4cfa22658c44aa73c2a9873", "content": "# CVE-2026-77633: CVE-2026-77633: Storage-quota Time-of-Check to Time-of-Use (TOCTOU) Race Condition in Cloudreve\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77633\n\n## Summary\nCloudreve before version 4.18.0 contains a Time-of-Check to Time-of-Use (TOCTOU) race condition in its storage-quota verification logic. Authenticated attackers with basic write access can trigger multiple parallel upload sessions to bypass their storage limits, leading to host disk space exhaustion and Denial of Service.\n\n## TL;DR\nA TOCTOU race condition in Cloudreve allows authenticated users to bypass their storage quota limits via concurrent upload sessions, causing host disk exhaustion.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-367 / CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.1 (High)\n- **Exploit Status**: PoC / Conceptual\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (DoS) via Disk Exhaustion\n\n## Affected Systems\n\n- Cloudreve\n- **Cloudreve**: < 4.18.0 (Fixed in: `4.18.0`)\n\n## Mitigation\n\n- Upgrade to Cloudreve version 4.18.0 or later.\n- Implement rate limiting at the reverse proxy level on upload endpoints.\n- Configure cloud storage policies (S3, B2, etc.) to isolate storage consumption.\n\n**Remediation Steps:**\n1. Stop the Cloudreve service.\n2. Download the Cloudreve v4.18.0 binary or build from source.\n3. Update your service configuration and restart the application.\n4. Configure rate limits in Nginx/Apache for POST requests targeting '/api/v3/file/upload'.\n\n## References\n\n- [NVD - CVE-2026-77633](https://nvd.nist.gov/vuln/detail/CVE-2026-77633)\n- [GitHub Security Advisory GHSA-xj3h-wwxq-gfcj](https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj)\n- [Cloudreve v4.18.0 Release Notes](https://github.com/cloudreve/cloudreve/releases/tag/4.18.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77633) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T05:32:15.168308Z"}]}