CVE-2026-45727: CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

Synopsis

A path traversal vulnerability in CloakBrowser's cloakserve CDP multiplexer allows an unauthenticated attacker to delete arbitrary directories on the host filesystem. The attacker reaches the service over the network (cloakserve binds to 0.0.0.0 by default) and supplies a crafted fingerprint query parameter containing path traversal sequences, causing shutil.rmtree() to delete directories outside the intended data directory. Successful exploitation overwrites or destroys filesystem content, potentially taking down dependent services or the host entirely. A patched-image rebuild at version 0.3.28 is available on HarborGuard for environments running an affected version of CloakBrowser.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the cloakserve port over the network; cloakserve binds to 0.0.0.0 by default, making it directly exposed on all interfaces.

• AuthenticationNot required

  No credentials or session token are needed; the fingerprint parameter is accepted from any unauthenticated HTTP request.

• Victim interactionNot required

  The exploit is fully server-side; no user action or social-engineering step is required to trigger the vulnerability.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs to supply a crafted path traversal string in the fingerprint query parameter with no race conditions or environmental dependencies.

Blast Radius

• Deletes arbitrary directories on the host filesystem by escaping the configured data_dir boundary through path traversal sequences.
• Destroys Chrome profile directories or any other directory reachable by the cloakserve process user, including application data and configuration trees.
• Causes service disruption to cloakserve and any dependent process whose working files reside in a deleted directory.