CVE-2026-54562

Deferred Deferred - Pending Action

Remote Download SSRF in Cloudreve Prior to 4.16.1

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, allowing a non-admin user with remote download permission to fetch internal-only URLs and read the response after it is imported into the user's own files. This issue is fixed in version 4.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-54562

EUVD

EUVD-2026-44687

Affected Vendors & Products

Vendor	Product	Version / Range
cloudreve	cloudreve	to 4.16.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-54562 is a Server-Side Request Forgery (SSRF) vulnerability in Cloudreve versions 4.16.0 and earlier. It allows non-admin users with remote download permissions to bypass security restrictions by submitting malicious URLs. The application fails to validate these URLs before passing them to the downloader, enabling access to internal or loopback services like localhost or IPv6 localhost.

Detection Guidance

Monitor network traffic for unusual outbound requests from Cloudreve, especially to localhost, 127.0.0.1, ::1, or private IP ranges. Check Cloudreve logs for POST requests to /api/v4/workflow/download with suspicious URLs. Use tools like tcpdump or Wireshark to inspect traffic from the Cloudreve process.

Impact Analysis

This vulnerability allows an attacker to read sensitive data from internal services not directly accessible to them. If you are a user with remote download permissions, an attacker could exploit this to access internal HTTP services, admin panels, or other network resources. The impact includes potential exposure of confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR or HIPAA compliance. Exposure of internal services may result in data breaches, triggering regulatory penalties or legal consequences for non-compliance.

Mitigation Strategies

Upgrade Cloudreve to version 4.16.1 or later immediately. If upgrading is not possible, disable the remote download feature for non-admin users or restrict URL input validation to block loopback and private addresses. Review user permissions to ensure only trusted users have remote download access.

Hi! I’m here to help you understand CVE-2026-54562. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70