CVE-2026-79913 json
Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses
published 2026-09-22 48 d ago modified 2026-10-01 38 d ago also EUVD-2026-84527 , GHSA-jvh5-97xg-v99f , GO-2026-6572
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4. This issue is fixed in version 4.18.0.
Patch / fix
- go github.com/cloudreve/Cloudreve/v4 4.0.0-20260715072853-1c5cad6dec7e
- cloudreve cloudreve 4.18.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 48 d ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/cloudreve/Cloudreve/v4 | <4.0.0-20260715072853-1c5cad6dec7e |
4.0.0-20260715072853-1c5cad6dec7e |
| go | github.com/cloudreve/Cloudreve | all versions |
no fix listed |
| go | github.com/cloudreve/Cloudreve/v3 | all versions |
no fix listed |
Affected products
- cloudreve cloudreve
Classification
References
-
github.com
/cloudreve/cloudreve/commit/1c5cad6dec7ec3037c6479e3a26a3909995d16a2
web
-
github.com
/cloudreve/cloudreve/security/advisories/GHSA-jvh5-97xg-v99f
web, advisory
-
github.com
/cloudreve/cloudreve/releases/tag/4.18.0
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-79913
advisory
-
github.com
/cloudreve/cloudreve
package
Sources
- CVE List CVE-2026-79913
- GitHub Advisory GHSA-jvh5-97xg-v99f
- NVD CVE-2026-79913
- OSV GO-2026-6572
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.