---
id: "CVE-2026-79913"
kind: "vulnerability"
aliases: ["CVE-2026-79913", "GHSA-jvh5-97xg-v99f", "GO-2026-6572"]
title: "Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve"
severity: "medium"
cvss: 6.5
epss: 0.00402
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/cloudreve/Cloudreve", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/cloudreve/Cloudreve/v3", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/cloudreve/Cloudreve/v4", "fixed": ["4.0.0-20260715072853-1c5cad6dec7e"], "affected": "< 4.0.0-20260715072853-1c5cad6dec7e", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cloud-hosting", "cloudreve", "go", "package", "remote-download", "self-hosted"]
not_affected_if: ["no-untrusted-users", "remote-download-disabled"]
published_at: "2026-09-22T16:17:57+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:46:11+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6572", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79913", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79913", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve

Cloudreve's SSRF guard does not decode NAT64, IPv4-compatible, or 6to4 IPv6 wrappers around IPv4 addresses, so it treats them as public. A logged-in user with remote-download access can make the server fetch loopback, private, or cloud metadata addresses and read the responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/cloudreve/Cloudreve affected all versions fixed ?
- go:github.com/cloudreve/Cloudreve/v3 affected all versions fixed ?
- go:github.com/cloudreve/Cloudreve/v4 affected < 4.0.0-20260715072853-1c5cad6dec7e fixed 4.0.0-20260715072853-1c5cad6dec7e

## How to check

Check the deployed Cloudreve version; the advisory says affected before 4.18.0, and govuln lists go module github.com/cloudreve/Cloudreve/v4 below 4.0.0-20260715072853-1c5cad6dec7e.

## Fix

Upgrade to Cloudreve 4.18.0 (advisory) or go module v4 4.0.0-20260715072853-1c5cad6dec7e (govuln); until then, restrict remote download to trusted users.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6572
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79913
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79913

## From the sources

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4. This issue is fixed in version 4.18.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_