opencloud-eu/reva

opencloud-eu/reva

GitHubGitHub
GitHubgithub.com
reva.linkreva.link
Releases169
Frequency2 weeks 9 hours
Last Release
Stars20
WebDAV/gRPC/HTTP high performance server to link high level clients to storage backends
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2026-23989↗
8.2 HIGH—

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.