CVE-2026-57500 · Package
NO FIX YET · SEE WHAT TO DO
REVA is an interoperability platform whose versions before 2.40.5 and 2.46.4 expose internal metadata folders inside the spaces of an authenticated user. An attacker with an account could interact with that data in ways the platform does not intend.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Deployments of REVA before 2.40.5 or 2.46.4 where users have accounts and access to spaces. The sources do not say which default configurations are affected. Deployments already on a patched version are not exposed.
Not affected if no-authenticated-users, patched-version
Who cares file-sharing, reva, self-hosted
2.40.5 and 2.46.42.40.5 or later on the 2.40.x line2.46.4 or later on the 2.46.x lineREVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.