Live › vulnerability › CVE-2026-79913
Go to dashboardCloudreve's SSRF guard does not decode NAT64, IPv4-compatible, or 6to4 IPv6 wrappers around IPv4 addresses, so it treats them as public. A logged-in user with remote-download access can make the server fetch loopback, private, or cloud metadata addresses and read the responses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/cloudreve/Cloudreve | go | all versions | – |
| github.com/cloudreve/Cloudreve/v3 | go | all versions | – |
| github.com/cloudreve/Cloudreve/v4 | go | < 4.0.0-20260715072853-1c5cad6dec7e | 4.0.0-20260715072853-1c5cad6dec7e |
Check the deployed Cloudreve version; the advisory says affected before 4.18.0, and govuln lists go module github.com/cloudreve/Cloudreve/v4 below 4.0.0-20260715072853-1c5cad6dec7e.
Upgrade to Cloudreve 4.18.0 (advisory) or go module v4 4.0.0-20260715072853-1c5cad6dec7e (govuln); until then, restrict remote download to trusted users.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4. This issue is fixed in version 4.18.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-79913")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.