GitHub Advisoryadvisory · PyPI

GHSA-mf33-gv72-w2h5 CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

HIGH Published 2026-05-18 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-45727
Ecosystem
PyPI
Packages
cloakbrowser
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-22
Reviewed
2026-05-18

Affected packages

• PyPI cloakbrowser: < 0.3.28 → fixed in 0.3.28

Description

The `cloakserve` CDP multiplexer uses the user-supplied `fingerprint` query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted `fingerprint` value containing path traversal sequences to resolve `user_data_dir` outside the configured `data_dir`. When Chrome fails to start or the process is cleaned up, `shutil.rmtree()` deletes the traversed path, resulting in arbitrary directory deletion. Additionally, `cloakserve` bound to `0.0.0.0` by default, making it network-exposed. Impact An attacker with network access to the cloakserve port can delete arbitrary directories accessible to the service user. Patches Fixed in v0.3.28. Mitigations • Upgrade to v0.3.28 or later • Restrict network access to the cloakserve port

Related

Alias · CVE (1)

  • CVE-2026-45727 CloakBrowser is a tool to bypass bot detection tests. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References