CVE-2026-79913 Details
Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4. This issue is fixed in version 4.18.0.
A server-side request forgery (SSRF) vulnerability has been identified in Cloudreve, a self-hosted file management and sharing system, in versions prior to 4.18.0. The issue arises in the SSRF guard within the 'ValidateExternalURL' function, located in 'pkg/request/ssrf.go'. This guard fails to properly decode certain IPv6 transition forms that embed internal IPv4 addresses before classifying them as safe or public. As a result, an authenticated user with remote-download access can exploit this flaw by providing a crafted URL that loops back to private or internal addresses, including cloud metadata services, thereby exposing sensitive information such as internal service responses and cloud instance credentials.
Users can upgrade to Cloudreve version 4.18.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cloudreve/cloudreve/commit/1c5cad6dec7ec3037c6479e3a26a3909995d16a2 | [email protected] | Source CodeVendor |
| https://github.com/cloudreve/cloudreve/releases/tag/4.18.0 | [email protected] | Release NotesVendor |
| https://github.com/cloudreve/cloudreve/security/advisories/GHSA-jvh5-97xg-v99f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-697 | Incorrect Comparison | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cloudreve | <= 4.17.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | [email protected] |