Reva: Exposure of internal metadata folders in user spaces

Summary

Reva, an interoperability platform used in the OpenCloud file-sync and share stack, exposes internal metadata folders within the spaces of an authenticated user. An attacker with a valid user account can interact with this data in ways the application does not intend. The attack is network-based with low complexity, but requires low privileges, and the CVSS impact is low for confidentiality, integrity and availability.

Affected

• Reva versions below 2.40.5
• Reva versions below 2.46.4
• Exact OpenCloud product versions bundling the affected Reva code: Unknown.

Fixed in

• Reva 2.40.5
• Reva 2.46.4

Workaround

Unknown. The vendor advisory states that no workaround is available; upgrading is required.

Exploitation

• No public proof of concept known at the time of research.
• Not known to be exploited in the wild; not listed in KEV.
• VulDB reports no publicly available exploit or technical details.

Our recommendation

• Identify OpenCloud or Reva instances in use and update to Reva 2.40.5 or 2.46.4 (or the corresponding OpenCloud release).
• Prioritise internet-facing instances and instances with self-registration or external guest accounts.
• Review access to spaces containing confidential client or HR data.
• Monitor the vendor advisory and NVD for updates, as the record was only published recently.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-57500 www.cve.org
• GitHub Security Advisory GHSA-3v8c-738m-4gcj github.com
• VulDB CVE-2026-57500 vuldb.com
• OffSeq Radar CVE-2026-57500 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:41.