{"id":"CVE-2026-79913","title":"Cloudreve is a self-hosted file management and sharing system","summary":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-697","CWE-918"],"vendor":"cloudreve","product":"cloudreve","affected":["cloudreve < 4.18.0"],"published":"2026-09-22","updated":"2026-09-22","sourceUpdated":"2026-09-22T18:17:19.667","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79913","references":[{"url":"https://github.com/cloudreve/cloudreve/commit/1c5cad6dec7ec3037c6479e3a26a3909995d16a2","label":"security-advisories@github.com"},{"url":"https://github.com/cloudreve/cloudreve/releases/tag/4.18.0","label":"security-advisories@github.com"},{"url":"https://github.com/cloudreve/cloudreve/security/advisories/GHSA-jvh5-97xg-v99f","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79913"},{"url":"https://github.com/advisories/GHSA-jvh5-97xg-v99f"},{"url":"https://github.com/cloudreve/cloudreve"}],"tags":["nvd","cve.org","ghsa","go","osv"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-22T17:33:06.764833Z"},"ingestedAt":"2026-09-22T16:06:00.492Z","aliases":["GHSA-jvh5-97xg-v99f"],"ecosystem":"go","patched":["github.com/cloudreve/Cloudreve/v4 4.0.0-20260715072853-1c5cad6dec7e"],"epss":0.00402,"epssPercentile":0.31591,"slug":"CVE-2026-79913","body":"## Overview\n\nCloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4. This issue is fixed in version 4.18.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-79913)\n\nAffected packages:\n\n- `github.com/cloudreve/Cloudreve/v4 < 4.0.0-20260715072853-1c5cad6dec7e`\n\nPatched in:\n\n- `github.com/cloudreve/Cloudreve/v4 4.0.0-20260715072853-1c5cad6dec7e`\n\nSource: https://github.com/advisories/GHSA-jvh5-97xg-v99f","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}