CVE-2026-77633

## Summary Cloudreve v4 splits the storage-quota **check** (reading the user's `used` bytes and comparing them to `MaxStorage`) and the **charge** (incrementing `users.storage`) into two non-atomic steps in the `PrepareUpload` code path. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition. Any authenticated user — including an unprivileged account in the default `User` group — can concurrently issue several upload-session requests that all read the same stale `used` snapshot, each pass the check, and then each contribute their declared `size` to `users.storage`. The end result is that the total approved capacity exceeds the group's `MaxStorage` many times over. The same primitive is trivially amplifiable into a storage-based denial of service. During `PrepareUpload`, Cloudreve reserves the declared size against `users.storage` before any bytes are written, so an attacker can push the reserved amount far beyond the host's physical disk (tested: a 1 GiB-quota account reserved 17 GiB in a single 20-way burst), and can then materialise the reservation by completing chunked uploads to actually write the excess bytes to disk. Amplification to the host's free space fills the disk and denies uploads for every user of the instance. Exploitation requires only a valid session with `Files.Write` permission. No administrator configuration, no non-default storage policy, and no elevated privileges are needed. The default deployment (local storage policy, default `User` group) is affected. ## Technical details `PrepareUpload` in `pkg/filemanager/fs/dbfs/upload.go` splits quota enforcement across two stages: **Stage A — the check (snapshot compare, no lock)** — `pkg/filemanager/fs/dbfs/validator.go`: ```go func (f *DBFS) validateUserCapacity(ctx context.Context, size int64, u *ent.User) error { capacity, err := f.Capacity(ctx, u) // reads "used" if err != nil { return ... } return f.validateUserCapacityRaw(ctx, size, capacity) } func