CVE-2026-54562

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, allowing a non-admin user with remote download permission to fetch internal-only URLs and read the response after it is imported into the user's own files. This issue is fixed in version 4.16.1.

• CWE-918

• https://github.com/cloudreve/cloudreve/commit/aaebf317a78f2413d74afd66c21a1f3143711312
• https://github.com/cloudreve/cloudreve/releases/tag/4.16.1
• https://github.com/cloudreve/cloudreve/security/advisories/GHSA-x756-g4x3-c64m
• https://github.com/cloudreve/cloudreve/security/advisories/GHSA-x756-g4x3-c64m

Published

Jul 15, 2026

Last Modified

Jul 15, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54545wakaru is a JavaScript decompiler and unminifier toolkit. Fr…7.1
• CVE-2026-5455A vulnerability was determined in Dialogue App up to 4.3.2 o…3.3
• CVE-2026-54555rtk filters and compresses command outputs before they reach…7.8
• CVE-2026-54557mise manages dev tools like node, python, cmake, and terrafo…5.5
• CVE-2026-5456A vulnerability was identified in Align Technology My Invisa…3.3
• CVE-2026-54560Cloudreve is a self-hosted file management and sharing syste…7.6
• CVE-2026-54563Cloudreve is a self-hosted file management and sharing syste…7.1
• CVE-2026-54568Microsoft UFO open-source framework for intelligent automati…4.3
• CVE-2026-5457A security flaw has been discovered in PropertyGuru AgentNet…3.3
• CVE-2026-54572Rclone is a command-line program to sync files and directori…8.8
• CVE-2026-54573Outline is a service that allows for collaborative documenta…5.3
• CVE-2026-54574proot-distro is a utility for managing proot containers. Pri…8.2