data/reports/GO-2026-5350.yaml

id: GO-2026-5350
modules:
    - module: github.com/cloudreve/Cloudreve
      vulnerable_at: 0.0.0-20201026073328-746aa3e8ef26
    - module: github.com/cloudreve/Cloudreve/v3
      vulnerable_at: 3.0.0-20250225100611-da4e44b77af4
    - module: github.com/cloudreve/Cloudreve/v4
      versions:
        - fixed: 4.0.0-20260205113604-ec9fdd33bc54
summary: |-
    Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token
    Generation (Insecure PRNG Seeding) in github.com/cloudreve/Cloudreve
cves:
    - CVE-2026-25726
ghsas:
    - GHSA-f8xp-wvcx-p6f4
references:
    - advisory: https://github.com/cloudreve/cloudreve/security/advisories/GHSA-f8xp-wvcx-p6f4
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-25726
    - web: https://github.com/cloudreve/cloudreve/releases/tag/4.13.0
notes:
    - fix: 'github.com/cloudreve/Cloudreve/v4: could not add vulnerable_at: could not find tagged version between introduced and fixed'
source:
    id: GHSA-f8xp-wvcx-p6f4
    created: 2026-06-25T02:49:21.061149077-04:00
review_status: UNREVIEWED