{"id":"CVE-2026-57500","kind":"vulnerability","aliases":["CVE-2026-57500"],"related":[],"title":"REVA: internal metadata folders exposed in authenticated users' spaces","description":"REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.","summary":"REVA is an interoperability platform whose versions before 2.40.5 and 2.46.4 expose internal metadata folders inside the spaces of an authenticated user. An attacker with an account could interact with that data in ways the platform does not intend.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-sharing","package","reva","self-hosted"],"not_affected_if":["no-authenticated-users","patched-version"],"how_to_check":"- Check the installed REVA version against `2.40.5` and `2.46.4`\n- Look for internal metadata folders visible in user spaces","fix":"- Upgrade to `2.40.5` or later on the 2.40.x line\n- Upgrade to `2.46.4` or later on the 2.46.x line","status":"open","published_at":"2026-11-11T19:17:42+00:00","first_seen_at":"2026-11-11T19:28:47+00:00","triaged_at":"2026-11-11T19:30:17+00:00","updated_at":"2026-11-11T19:30:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T19:30:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `2.40.5` or later on the 2.40.x line\n- Upgrade to `2.46.4` or later on the 2.46.x line","reach":"network","title":"REVA: internal metadata folders exposed in authenticated users' spaces","impact":"medium","summary":"REVA is an interoperability platform whose versions before 2.40.5 and 2.46.4 expose internal metadata folders inside the spaces of an authenticated user. An attacker with an account could interact with that data in ways the platform does not intend.","audience":"businesses","category":"package","nicknames":[],"who_cares":["reva","self-hosted","file-sharing"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads or alters internal metadata folders","analyst_note":"","how_to_check":"- Check the installed REVA version against `2.40.5` and `2.46.4`\n- Look for internal metadata folders visible in user spaces","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","no-authenticated-users"],"who_is_affected":"Deployments of REVA before 2.40.5 or 2.46.4 where users have accounts and access to spaces. The sources do not say which default configurations are affected. Deployments already on a patched version are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":4545,"output_tokens":495,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-57500':12A,15A '2.40.5':32B,71C,104C '2.46.4':34B,73C,106C 'account':50B 'attack':47B 'authent':7A,44B,84C 'could':51B 'cve':10A,13A 'data':55B,96C 'expos':5A,35B,75C 'file':17B 'file-shar':16B 'folder':4A,38B,78C 'host':23B 'insid':39B 'intend':62B 'interact':52B,93C 'intern':2A,36B,76C 'interoper':27B,66C 'issu':98C 'lead':88C 'metadata':3A,37B,77C 'packag':19B 'patch':101C 'platform':28B,59B,67C 'prior':68C 'reva':1A,20B,24B,63C,74C 'self':22B 'self-host':21B 'share':18B 'space':9A,41B,81C 'unwant':90C 'user':8A,45B,85C 'version':30B,70C,103C 'way':57B,91C 'whose':29B","nicknames":[],"mitigations":[],"who_affected":"Deployments of REVA before 2.40.5 or 2.46.4 where users have accounts and access to spaces. The sources do not say which default configurations are affected. Deployments already on a patched version are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["filesharing","medium","package","reva","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-57500':12A,15A 'authent':7A 'cve':10A,13A 'expos':5A 'folder':4A 'intern':2A 'metadata':3A 'reva':1A 'space':9A 'user':8A","search_b":"'2.40.5':32B '2.46.4':34B 'account':50B 'attack':47B 'authent':44B 'could':51B 'data':55B 'expos':35B 'file':17B 'file-shar':16B 'folder':38B 'host':23B 'insid':39B 'intend':62B 'interact':52B 'intern':36B 'interoper':27B 'metadata':37B 'packag':19B 'platform':28B,59B 'reva':20B,24B 'self':22B 'self-host':21B 'share':18B 'space':41B 'user':45B 'version':30B 'way':57B 'whose':29B","search_c":"'2.40.5':71C,104C '2.46.4':73C,106C 'authent':84C 'data':96C 'expos':75C 'folder':78C 'interact':93C 'intern':76C 'interoper':66C 'issu':98C 'lead':88C 'metadata':77C 'patch':101C 'platform':67C 'prior':68C 'reva':63C,74C 'space':81C 'unwant':90C 'user':85C 'version':70C,103C 'way':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T12:19:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57500","severity":null,"published_at":"2026-11-11T19:17:42+00:00","modified_at":"2026-11-11T19:17:42+00:00","first_seen_at":"2026-11-11T19:28:47+00:00","fetched_at":"2026-11-11T19:28:47+00:00","note":null}],"documents":[{"id":128133,"url":"https://github.com/opencloud-eu/reva/security/advisories/GHSA-3v8c-738m-4gcj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T12:19:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}