{"id":"PYSEC-2026-2420","summary":"CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion","details":"The `cloakserve` CDP multiplexer uses the user-supplied `fingerprint` query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted `fingerprint` value containing path traversal sequences to resolve `user_data_dir` outside the configured `data_dir`. When Chrome fails to start or the process is cleaned up, `shutil.rmtree()` deletes the traversed path, resulting in arbitrary directory deletion.\n\nAdditionally, `cloakserve` bound to `0.0.0.0` by default, making it network-exposed.\n\n### Impact\n\nAn attacker with network access to the cloakserve port can delete arbitrary directories accessible to the service user.\n\n### Patches\n\nFixed in v0.3.28.\n\n### Mitigations\n\n- Upgrade to v0.3.28 or later\n- Restrict network access to the cloakserve port","aliases":["CVE-2026-45727","GHSA-mf33-gv72-w2h5"],"modified":"2026-07-13T16:31:42.471778574Z","published":"2026-07-13T15:19:08.809070Z","references":[{"type":"WEB","url":"https://github.com/CloakHQ/CloakBrowser/security/advisories/GHSA-mf33-gv72-w2h5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45727"},{"type":"PACKAGE","url":"https://github.com/CloakHQ/CloakBrowser"},{"type":"PACKAGE","url":"https://pypi.org/project/cloakbrowser"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mf33-gv72-w2h5"}],"affected":[{"package":{"name":"cloakbrowser","ecosystem":"PyPI","purl":"pkg:pypi/cloakbrowser"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.28"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.10","0.3.11","0.3.12","0.3.13","0.3.14","0.3.15","0.3.16","0.3.17","0.3.18","0.3.19","0.3.2","0.3.20","0.3.21","0.3.22","0.3.23","0.3.24","0.3.25","0.3.26","0.3.27","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/cloakbrowser/PYSEC-2026-2420.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N"}]}