CVE-2026-25726
Cloudreve ≤ 4.13.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-25726 is a high-severity PRNG (CWE-338) vulnerability in Cloudreve Cloudreve. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Forge Web Credentials (T1606); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25726 affects Cloudreve, an open-source self-hosted file management and sharing system, in versions prior to 4.13.0. The vulnerability stems from the use of a weak pseudo-random number generator from the math/rand package, seeded solely with time.Now().UnixNano(), to generate critical security secrets such as the secret_key and hash_id_salt. These secrets are created during the application's first startup and stored persistently in the database, making them predictable under certain conditions due to the limited entropy in the seed.
A remote attacker without privileges can exploit this issue by first querying public API endpoints to obtain the administrator's account creation time, which narrows the feasible search window for the PRNG seed. Using a known hashid value for validation, the attacker can then brute-force the seed—demonstrated to require less than three hours on a general consumer PC—to derive the secret_key. With the secret_key, the attacker can forge valid JSON Web Tokens (JWTs) impersonating any user, including administrators, resulting in full account takeover and privilege escalation. The CVSS v3.1 base score of 8.1 reflects network accessibility with high attack complexity but high impacts on confidentiality, integrity, and availability (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
The issue has been addressed in Cloudreve version 4.13.0, as detailed in the project's release notes and security advisory. Practitioners should upgrade to this patched version to mitigate the vulnerability, with further details available in the GitHub release at https://github.com/cloudreve/cloudreve/releases/tag/4.13.0 and the advisory at https://github.com/cloudreve/cloudreve/security/advisories/GHSA-f8xp-wvcx-p6f4.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18833
Vulnerability Data
Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand seeded with time.Now().UnixNano() to generate critical security secrets, including the secret_key, and hash_id_salt. These secrets are generated upon…
more
first startup and persisted in the database. An attacker can exploit this by obtaining the administrator's account creation time (via public API endpoints) to narrow the search window for the PRNG seed, and use known hashid to validate the seed. By brute-forcing the seed (demonstrated to take <3 hours on general consumer PC), an attacker can predict the secret_key. This allows them to forge valid JSON Web Tokens (JWTs) for any user, including administrators, leading to full account takeover and privilege escalation. This issue has been patched in version 4.13.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 3 hardening rules · 3 OS baselines
V7.2.3V11.5.1
Mitigating Controls (NIST 800-53 r5) AI
Requiring specific approved cryptography for protection directly mandates use of strong PRNGs instead of weak ones.
Engineering principles applied during design and development include selection of cryptographically strong random number generation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly require cryptographically strong RNG selection and usage in security contexts.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates use of approved cryptographic controls, directly requiring cryptographically strong RNGs.
Security testing can detect use of weak random number generators.
Secure SDLC processes should catch weak PRNG usage during design and code review.
Application security requirements can specify cryptographically strong random number generation.
Secure engineering principles include selection of appropriate cryptographic primitives.
Secure coding standards prohibit use of weak PRNGs in security contexts.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248563 The OL 8 SSH server must be configured to use strong entropy. prevents CWE-338
RHEL 8 (1 rule)
- V-230253 RHEL 8 must ensure the SSH server uses strong entropy. prevents CWE-338
Ubuntu 22.04 (1 rule)
- V-260650 Ubuntu 22.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-338