CVE-2026-45727 is a high-severity path traversal vulnerability (CWE-22) in CloakHQ CloakBrowser's cloakserve component before version 0.3.28. The vulnerability arises because the user-supplied fingerprint query parameter is used directly as part of the filesystem path for Chrome profile directories. An attacker with network access to the cloakserve port can supply crafted input containing path traversal sequences to escape the configured data directory. When Chrome fails to start or the process is cleaned up, the code calls shutil.rmtree() on the resolved path, resulting in arbitrary directory deletion. By default, cloakserve binds to 0.0.0.0, exposing the service to network attackers. The vulnerability is patched in version 0.3.28.

An unauthenticated remote attacker can cause arbitrary directory deletion on the host filesystem by exploiting the path traversal vulnerability in cloakserve. This can lead to denial of service or data loss by deleting critical directories outside the intended data directory. The network exposure of the service by default increases the attack surface. There are no known exploits in the wild as of the published date.

Upgrade CloakBrowser to version 0.3.28 or later, where this vulnerability is patched. Until upgraded, restrict network access to the cloakserve port to trusted users only to prevent unauthenticated exploitation. No other vendor advisory or patch information is provided; therefore, patch status is confirmed by the version update.