CVE-2026-79913

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-79913

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79913.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-79913

Aliases

Published

2026-09-22T15:24:33Z

Modified

2026-10-28T02:30:52Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

Details

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4. This issue is fixed in version 4.18.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-697",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79913.json"
}

References

Affected packages

Git / github.com/cloudreve/cloudreve

Affected ranges

Type

GIT

Repo

https://github.com/cloudreve/cloudreve

Events

Introduced

Fixed

0bb0ab833571d380153edd3529e01a7957b8b4ce

Fixed

1c5cad6dec7ec3037c6479e3a26a3909995d16a2

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.18.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "1c5cad6dec7ec3037c6479e3a26a3909995d16a2"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "4.18.0",
            "range": [
                {
                    "fixed": "0bb0ab833571d380153edd3529e01a7957b8b4ce"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

3.*

3.0.0

3.0.0-beta1

3.0.0-beta2

3.0.0-beta3

3.0.0-rc1

3.1.0

3.1.1

3.2.0

3.2.1

3.3.0

3.3.1

3.3.2

3.4.0

3.4.0-beta1

3.4.1

3.4.2

3.5.0

3.5.0-beta.3

3.5.0-beta1

3.5.0-beta2

3.5.1

3.5.2

3.5.3

3.6.0

3.6.0-beta1

3.6.1

3.6.2

3.7.0

3.7.1

3.8.0

3.8.0-beta1

3.8.1

3.8.2

3.8.3

4.*

4.0.0

4.0.0-beta.10

4.0.0-beta.11

4.0.0-beta.12

4.0.0-beta.13

4.0.0-beta.14

4.0.0-beta.6

4.0.0-beta.7

4.0.0-beta.8

4.0.0-beta.9

4.1.0

4.1.1

4.1.2

4.1.3

4.10.0

4.10.1

4.11.0

4.11.1

4.12.0

4.12.1

4.13.0

4.14.0

4.14.1

4.15.0

4.16.0

4.16.1

4.17.0

4.2.0

4.3.0

4.4.0

4.4.1

4.5.0

4.5.1

4.6.0

4.7.0

4.8.0

4.9.0

4.9.1

4.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79913.json"