---
id: CVE-2026-79913
title: Cloudreve is a self-hosted file management and sharing system
summary: >-
  Cloudreve is a self-hosted file management and sharing system. Prior to
  4.18.0, the ValidateExternalURL server-side request forgery guard in
  pkg/request/ssrf.go passes resolved addresses to checkIP without decoding
  NAT64, IPv4-compatible…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-697
  - CWE-918
vendor: cloudreve
product: cloudreve
affected:
  - cloudreve < 4.18.0
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T18:17:19.667'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79913'
references:
  - url: >-
      https://github.com/cloudreve/cloudreve/commit/1c5cad6dec7ec3037c6479e3a26a3909995d16a2
    label: security-advisories@github.com
  - url: 'https://github.com/cloudreve/cloudreve/releases/tag/4.18.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/cloudreve/cloudreve/security/advisories/GHSA-jvh5-97xg-v99f
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79913'
  - url: 'https://github.com/advisories/GHSA-jvh5-97xg-v99f'
  - url: 'https://github.com/cloudreve/cloudreve'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - osv
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T17:33:06.764833Z'
ingestedAt: '2026-09-22T16:06:00.492Z'
aliases:
  - GHSA-jvh5-97xg-v99f
ecosystem: go
patched:
  - github.com/cloudreve/Cloudreve/v4 4.0.0-20260715072853-1c5cad6dec7e
epss: 0.00402
epssPercentile: 0.31682
---

## Overview

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4. This issue is fixed in version 4.18.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-79913)

Affected packages:

- `github.com/cloudreve/Cloudreve/v4 < 4.0.0-20260715072853-1c5cad6dec7e`

Patched in:

- `github.com/cloudreve/Cloudreve/v4 4.0.0-20260715072853-1c5cad6dec7e`

Source: https://github.com/advisories/GHSA-jvh5-97xg-v99f