{"id":"CVE-2026-79913","kind":"vulnerability","aliases":["CVE-2026-79913","GHSA-jvh5-97xg-v99f","GO-2026-6572"],"related":[],"title":"Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve","description":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4. This issue is fixed in version 4.18.0.","summary":"Cloudreve's SSRF guard does not decode NAT64, IPv4-compatible, or 6to4 IPv6 wrappers around IPv4 addresses, so it treats them as public. A logged-in user with remote-download access can make the server fetch loopback, private, or cloud metadata addresses and read the responses.","severity":"medium","cvss":6.5,"epss":0.00402,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/cloudreve/Cloudreve","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/cloudreve/Cloudreve/v3","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/cloudreve/Cloudreve/v4","fixed":["4.0.0-20260715072853-1c5cad6dec7e"],"affected":"< 4.0.0-20260715072853-1c5cad6dec7e","ecosystem":"go"}],"ecosystems":["go"],"tags":["cloud-hosting","cloudreve","go","package","remote-download","self-hosted"],"not_affected_if":["no-untrusted-users","remote-download-disabled"],"how_to_check":"Check the deployed Cloudreve version; the advisory says affected before 4.18.0, and govuln lists go module github.com/cloudreve/Cloudreve/v4 below 4.0.0-20260715072853-1c5cad6dec7e.","fix":"Upgrade to Cloudreve 4.18.0 (advisory) or go module v4 4.0.0-20260715072853-1c5cad6dec7e (govuln); until then, restrict remote download to trusted users.","status":"open","published_at":"2026-09-22T16:17:57+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:46:11+00:00","updated_at":"2026-10-23T21:46:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:46:11Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to Cloudreve 4.18.0 (advisory) or go module v4 4.0.0-20260715072853-1c5cad6dec7e (govuln); until then, restrict remote download to trusted users.","reach":"internet","impact":"medium","summary":"Cloudreve's SSRF guard does not decode NAT64, IPv4-compatible, or 6to4 IPv6 wrappers around IPv4 addresses, so it treats them as public. A logged-in user with remote-download access can make the server fetch loopback, private, or cloud metadata addresses and read the responses.","category":"package","who_cares":["cloudreve","self-hosted","remote-download","cloud-hosting","go"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads internal service responses and cloud instance credentials via server-side fetch","analyst_note":"Sources conflict on fixed version (advisory says 4.18.0, govuln says 4.0.0-20260715072853-1c5cad6dec7e); confirm at https://nvd.nist.gov/vuln/detail/CVE-2026-79913 or GHSA-jvh5-97xg-v99f and whether remote download is on by default.","how_to_check":"Check the deployed Cloudreve version; the advisory says affected before 4.18.0, and govuln lists go module github.com/cloudreve/Cloudreve/v4 below 4.0.0-20260715072853-1c5cad6dec7e.","needs_analyst":true,"not_affected_if":["remote-download-disabled","no-untrusted-users"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.001166,"input_tokens":3244,"output_tokens":1684,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':30A,38A,41A '-6572':39A '-79913':31A,42A '/cloudreve/cloudreve':28A,45A '/cloudreve/cloudreve/v3':48A '/cloudreve/cloudreve/v4':51A '4.18.0':126C,219C '6to4':17A,76B,149C '97xg':35A 'access':97B,163C 'address':24A,81B,108B,139C,183C,202C 'around':79B 'authent':157C 'block':204C 'bypass':4A 'checkip':5A,141C 'classifi':185C 'cloud':22A,53B,106B,180C,195C 'cloud-host':52B 'cloud-metadata':21A 'cloudrev':1A,55B,64B,113C 'compat':16A,74B,147C 'convert':207C 'credenti':197C 'cve':29A,40A 'decod':8A,70B,143C 'download':60B,96B,162C 'embed':172C 'expos':190C 'fetch':102B,189C 'file':119C 'fix':216C 'forgeri':133C 'form':155C,209C 'ghsa':33A 'ghsa-jvh5-97xg-v99f':32A 'github.com':27A,44A,47A,50A 'github.com/cloudreve/cloudreve':26A,43A 'github.com/cloudreve/cloudreve/v3':46A 'github.com/cloudreve/cloudreve/v4':49A 'go':37A,56B,206C 'guard':3A,67B,134C 'host':54B,63B,118C 'instanc':196C 'intern':19A,191C 'ipv4':15A,73B,80B,146C,151C,182C,199C 'ipv4-compatible':14A,72B,145C 'ipv4-in-ipv6':150C 'ipv4-mapped':198C 'ipv6':10A,77B,153C,201C 'ipv6-transition':9A 'issu':214C 'jvh5':34A 'link':177C 'link-loc':176C 'local':178C 'log':90B 'logged-in':89B 'loopback':103B,174C 'make':99B 'manag':120C 'map':200C 'metadata':23A,107B,181C 'nat64':13A,71B,144C 'net.ip':211C 'packag':57B 'pass':137C 'pkg/request/ssrf.go':136C 'prior':124C 'privat':104B,175C 'provid':165C 'public':87B,187C 'reach':18A 'read':110B 'remain':203C 'remot':59B,95B,161C 'remote-download':58B,94B,160C 'remotedownloadtask.createdownloadtask':168C 'request':132C 'resolv':138C 'respons':112B,193C 'self':62B,117C 'self-host':61B,116C 'server':101B,130C 'server-sid':129C 'servic':192C 'share':122C 'side':131C 'srcuri':166C 'ssrf':2A,66B 'system':123C 'to4':212C 'transit':11A,154C 'treat':84B 'user':92B,158C 'v99f':36A 'validateexternalurl':128C 'version':218C 'without':142C 'wrapper':12A,78B,171C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T16:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6572","url":"https://pkg.go.dev/vuln/GO-2026-6572","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79913","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79913","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-79913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79913","severity":null,"published_at":"2026-09-22T16:17:57+00:00","modified_at":"2026-09-22T18:17:19+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}