---
id: "CVE-2026-57500"
page: "https://infrastack.ai/live/CVE-2026-57500"
kind: "vulnerability"
aliases: ["CVE-2026-57500"]
title: "REVA: internal metadata folders exposed in authenticated users' spaces"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["file-sharing", "package", "reva", "self-hosted"]
not_affected_if: ["no-authenticated-users", "patched-version"]
published_at: "2026-11-11T19:17:42+00:00"
first_seen_at: "2026-11-11T19:28:47+00:00"
updated_at: "2026-11-11T19:30:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57500", "first_seen_at": "2026-11-11T19:28:47+00:00"}]
exploit_sources: []
---

# REVA: internal metadata folders exposed in authenticated users' spaces

Link for people: https://infrastack.ai/live/CVE-2026-57500 (this .md is for agents)

REVA is an interoperability platform whose versions before 2.40.5 and 2.46.4 expose internal metadata folders inside the spaces of an authenticated user. An attacker with an account could interact with that data in ways the platform does not intend.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed REVA version against `2.40.5` and `2.46.4`
- Look for internal metadata folders visible in user spaces

## Fix

- Upgrade to `2.40.5` or later on the 2.40.x line
- Upgrade to `2.46.4` or later on the 2.46.x line

## Timeline

- 2026-11-11T19:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57500

## Documents

- [advisory] Vendor advisory: github.com https://github.com/opencloud-eu/reva/security/advisories/GHSA-3v8c-738m-4gcj

## From the sources

REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_