id: PYSEC-2026-2420
published: "2026-07-13T15:19:08.809070Z"
modified: "2026-07-13T16:03:44.072624Z"
aliases:
- CVE-2026-45727
- GHSA-mf33-gv72-w2h5
summary: "CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion"
details: "The `cloakserve` CDP multiplexer uses the user-supplied `fingerprint` query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted `fingerprint` value containing path traversal sequences to resolve `user_data_dir` outside the configured `data_dir`. When Chrome fails to start or the process is cleaned up, `shutil.rmtree()` deletes the traversed path, resulting in arbitrary directory deletion.\n\nAdditionally, `cloakserve` bound to `0.0.0.0` by default, making it network-exposed.\n\n### Impact\n\nAn attacker with network access to the cloakserve port can delete arbitrary directories accessible to the service user.\n\n### Patches\n\nFixed in v0.3.28.\n\n### Mitigations\n\n- Upgrade to v0.3.28 or later\n- Restrict network access to the cloakserve port"
affected:
- package:
    name: cloakbrowser
    ecosystem: PyPI
    purl: pkg:pypi/cloakbrowser
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.3.28
  versions:
  - 0.1.0
  - 0.1.1
  - 0.1.10
  - 0.1.11
  - 0.1.12
  - 0.1.2
  - 0.1.3
  - 0.1.4
  - 0.1.5
  - 0.1.6
  - 0.1.7
  - 0.1.8
  - 0.1.9
  - 0.2.0
  - 0.2.1
  - 0.2.2
  - 0.3.0
  - 0.3.1
  - 0.3.10
  - 0.3.11
  - 0.3.12
  - 0.3.13
  - 0.3.14
  - 0.3.15
  - 0.3.16
  - 0.3.17
  - 0.3.18
  - 0.3.19
  - 0.3.2
  - 0.3.20
  - 0.3.21
  - 0.3.22
  - 0.3.23
  - 0.3.24
  - 0.3.25
  - 0.3.26
  - 0.3.27
  - 0.3.4
  - 0.3.5
  - 0.3.6
  - 0.3.7
  - 0.3.8
  - 0.3.9
references:
- type: WEB
  url: https://github.com/CloakHQ/CloakBrowser/security/advisories/GHSA-mf33-gv72-w2h5
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-45727
- type: PACKAGE
  url: https://github.com/CloakHQ/CloakBrowser
- type: PACKAGE
  url: https://pypi.org/project/cloakbrowser
- type: ADVISORY
  url: https://github.com/advisories/GHSA-mf33-gv72-w2h5
severity:
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N