CVE-2026-79913
Deferred Deferred - Pending Action

Cloudreve Remote-Download SSRF via NAT64 IPv4-in-IPv6 Bypass

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4. This issue is fixed in version 4.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-79913
EUVD
EUVD-2026-84527

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cloudreve cloudreve to 4.18.0 (exc)
cloudreve cloudreve 4.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79913 is a Server-Side Request Forgery (SSRF) vulnerability in Cloudreve versions 4.17.0 and earlier. The issue occurs in the ValidateExternalURL function which fails to properly decode IPv6-transition wrappers like NAT64, IPv4-compatible addresses, and 6to4 addresses. This allows an attacker to bypass SSRF protections by embedding internal IPv4 addresses within these IPv6 wrappers.

Detection Guidance

To detect this SSRF vulnerability in Cloudreve, check if your system is running versions 4.17.0 or earlier. Review logs for unexpected outbound requests to internal IP addresses or cloud metadata services (e.g., 169.254.169.254). Use network monitoring tools like tcpdump or Wireshark to inspect traffic from the Cloudreve process. Verify if the ValidateExternalURL function improperly handles IPv6-transition addresses by testing with crafted URLs containing NAT64, 6to4, or IPv4-compatible formats.

Impact Analysis

An authenticated user with remote-download access can exploit this vulnerability by providing a crafted SrcUri through RemoteDownloadTask.createDownloadTask. This causes the server to fetch internal URLs, potentially exposing sensitive data like cloud instance metadata credentials. Attackers could gain privilege escalation within the cloud account.

Mitigation Strategies

Upgrade Cloudreve to version 4.18.0 or later immediately. If upgrading is not possible, apply the patch from the commit 1c5cad6dec7ec3037c6479e3a26a3909995d16a2 which introduces the effectiveIP function to properly validate IPv4-in-IPv6 addresses. Disable remote-download functionality if unused. Restrict outbound network access for the Cloudreve service to prevent unauthorized requests. Monitor for suspicious activity in logs and network traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79913. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart