Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

cloakbrowser

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8PyPIAmendedPublished

    CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

    CVE-2026-45727 · GHSA-mf33-gv72-w2h5

    Affected
    • PyPI cloakbrowser <= 0.3.27
    Fixed in
    0.3.28· Vendor fix available
    Issue
    The cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted fingerprint value containing path traversal sequences to resolve userdatadir outside the configured datadir. When Chrome fails to start or the process is cleaned up, shutil.rmtree() deletes the traversed path, resulting in arbitrary directory deletion. Additionally, cloakserve bound to 0.0.0.0 by default, making it network-exposed. Impact An attacker with network access to the cloakserve port can delete arbitrary directories accessible to the service user. Patches Fixed in v0.3.28. Mitigations - Upgrade to v0.3.28 or later - Restrict network access to the cloakserve port

    Recommended action: Upgrade to 0.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →