CVE-2026-54562 Details
Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, allowing a non-admin user with remote download permission to fetch internal-only URLs and read the response after it is imported into the user's own files. This issue is fixed in version 4.16.1.
A server-side request forgery (SSRF) vulnerability has been identified in Cloudreve's remote download feature, prior to version 4.16.1. This issue allows non-admin users with remote download permissions to access internal URLs via the server's downloader. The vulnerability arises because the application fails to validate user-supplied URLs before processing them, leaving internal services exposed. Exploitation can be achieved by redirecting to loopback addresses or by directly accessing internal-only URLs, with the response being imported into the user's Cloudreve files.
Users can update to Cloudreve version 4.16.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cloudreve/cloudreve/security/advisories/GHSA-x756-g4x3-c64m | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/cloudreve/cloudreve/commit/aaebf317a78f2413d74afd66c21a1f3143711312 | [email protected] | Source CodeVendor |
| https://github.com/cloudreve/cloudreve/releases/tag/4.16.1 | [email protected] | Release NotesVendor |
| https://github.com/cloudreve/cloudreve/security/advisories/GHSA-x756-g4x3-c64m | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cloudreve | <= 4.16.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |