GO-2026-6572

vendorUSosv

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve

view advisory published 2026-10-01Licence: per source

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-79913US	—	0.40% (34th)	—	2026-09-22
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved add…

references

External citations — patches, advisories, analysis.

https://github.com/cloudreve/cloudreve/commit/1c5cad6dec7ec3037c6479e3a26a3909995d16a2WEB
https://github.com/cloudreve/cloudreve/releases/tag/4.18.0WEB
https://github.com/cloudreve/cloudreve/security/advisories/GHSA-jvh5-97xg-v99fADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-79913ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan