CVE-2026-45727

Affected versions of the cloakbrowser package are vulnerable to Path Traversal leading to Arbitrary Directory Deletion due to the cloakserve CDP multiplexer using the user-supplied fingerprint query parameter directly as a filesystem path component without sanitisation. The fingerprint value is used to construct the Chrome profile user_data_dir path, and when Chrome fails to start or the process is cleaned up, shutil.rmtree() deletes the traversed path outside the configured data_dir. An unauthenticated attacker with network access to the cloakserve port can delete arbitrary directories accessible to the service user by supplying path traversal sequences in the fingerprint parameter.